Bring back menus, QR codes are terrible

I was always wondering, how secure are QR code menus? What if someone will quietly put identically looking QR code that would point not to https://coolcafe.xyz/menu/table/5, but to https://thecoolcafe.xyz/menu/table/5, that is a full copy of the legit site, just with payment form logging CC details and then throwing some vague error and then redirecting to legit site (or even more elaborate scam with proxying all requests to legit site and logging all data)? Should be pretty low-effort and low-risk operation to collect CC details. Clients do not know which site they expect to land on when they scan that QR code.