I honestly do not see what other method should be used. QR codes are pretty good to transfer information locally. I mean sure, you could ask the user to type it, but I do not think that is practical ...

Russian state-aligned threat actors are ramping up efforts to spy on Ukrainian military and government officials via their secure messaging applications, including Signal Messenger and WhatsApp, ...

If a QR Code plus the user clicking through some authorizations can compromise the device, that may or may not be a defect in the software. It's very hard to totally eliminate this type of channel ...