Yes a scammer could try and impersonate you or send shady links that could trick you into giving out permissions on your phone. I'm a bit paranoid and never scan rogue QR for those reasons.