> requires scanning a QR code

That's like saying you need to "scan a QR code" to open a train door, not mentioning that the real requirement is linking your phone to your payment data so they can bill you. It's not the ability to turn a data matrix into bytes that Google is verifying here...