It's hard to say as there isn't any specific data regarding this.  Mainly bad actors use QR codes to phish users, a spin on the standard email scam.  The only way I see malware being successful is if the resulting URL has information about disabling security features of your phone to install malware.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence