Did domain names stop functioning all of the sudden? Going to somedipshitsbar.com/menu is about as complicated as entering a wifi password at a coffee shop.
Its like two taps on my phone to scan a QR code where as typing that is probably going to take me 26+ taps.
And I usually prefer to just scan a QR code to get the wifi details. Once again, its far fewer taps.
If you could do something with just two clicks or do something with 26 clicks, which path would you normally take?
Consumers don't care. QR is easier for them and owners get analytics plus built in table identified ordering. I brought up the attack vector to a table full of developers back when this was taking off, just shrugs.