Technically yes and more likely possible if you choose to scan a QR code found on a random web page but you are less likely to be exposed to such malware if you scan a QR to pay vendors or restaurants and typically you will scan the QR code via the money paying app which will tell you that the QR code is a valid address and if not it gives you invalid that is what the security measures inbuilt in those apps.