Yeah. Under the assumption every device is compromised or compromisable. The risky part of paper wallets is importing/sweeping the private key. So it's desirable to spend all the funds and get rid of that paper (you can spend some funds to another unused paper though).
So the problem here is when I scan the private key? It would mean that the people who provide these QR Code scanners have malicious intentions and claim my Private Key if they log data? I'm not sure why these scanner services are all malicious, considering that blockchain.com is the platform I use to redeem Paper Wallets. Or is the danger that someone could take a picture of the QR code when I scan it?