I mean, random NFC tags, I can understand. But, isn’t advising someone to avoid QR codes obsolete by now? It was a pretty worthwhile attack vector at one point, but nowadays most phones will ask “Do you want to <handle> <contents in full>?” before actually doing anything with it…

Although, now that I think about it, it is best practice to advise to the lowest common denominator… Sometimes I overestimate users’ ability to avoid doing stupid things…