Air-gapped hardware wallets that employ QR codes and cameras as a means to transfer data between devices are considered one of the most secure options of interacting with potentially malicious software. Naturally, this communication channel has its own drawbacks and attack vectors, one of which being a maliciously altered communication channel (hackers trying to exploit vulnerabilities in a hardware wallet by sending specific tampered data via QR-code-encoded messages). You can't keep hardware wallets fully isolated from the outside world (even the most secure and sophisticated ones) unless you never make transactions using them, which is ridiculous.