What's the format of the text to be encoded into the QR code? Just the 12 words separated by spaces?

Edit: "Just the 12 words separated by spaces" seems to be exactly what the QR code needs to encode.

That seems like a good solution. Stealing the phone gets the thief nothing. Stealing the QR code gets them nothing without the passphrase(s). You can use multiple passphrases and get completely different sets of addresses, so a longer passphrase could be used to store less-frequently used coins.

Is it documented how the passphrase modifies the seed?

Edit2: the passphrase is the standard BIP39 passphrase. Something like https://dcpos.github.io/bip39/ can be used to generate the addresses to fund the BIP39 accounts.

One thing I noticed when spending from a master seed is that the accounts are numbered wrongly:

m/44'/0'/0' is called 'Account 1',
m/44'/0'/1' is called 'Account 2',
m/44'/0'/2' is called 'Account 3',
etc.