How many characters can we say are safe if we verify them? I don't think there is a database or even an attempt to generate a similar address for the first and last 6 characters (58^12 = 1.45 * 10^21)? True.
Generally, you can increase the difficulty by taking the first 3 letters, the last 3 letters and 2 random letters from the middle.
Do such viruses affect QR scanning?
#Edit: Maybe I found an answer:
In the instance that was reported to us, only the first and last 2 characters matched. Excluding the starting '1' , that's 3 characters. Might be bruteforced locally.