It's probably because if someone were to get your static barcode (some account number?), they'd be able to use it immediately and forever. Whereas the QR code is a payment link that authenticates on the backend. Kind of like a credit card magstrip versus the chip.