Do not scan QR code you find online, only scan when paying to another crypto wallet or you want to sell your BTC on an exchange, QR codes can come with malicious things too.
In a proper airgapped wallet you should not be scanning any QR codes not related to a transaction detail, when switching from a watch only to the wallet for signing the transaction. You should not even be sending out from the wallet cause it should be a cold wallet.
100% security exists technically, but is difficult to attain, but we should try to get as close as possible.