----
So the vulmerability can come from:
a)Malware changing the QR code
b)Malware on the code reader (app and/or terminal)
c)all of the above
Copy pasting and the hand-checking the address seems "safer" if that's true....
It is also possible the malware will change what is displayed on your computer. So your computer would display 3_correct_address, however in reality, the malware is actually sending coin to 3_maleware_creator_address. Or malware could not touch anything you input, and simply grab your private keys once you decrypt your wallet, and send all your coin to 3_maleware_creator_address.