The advice to point codes at a domain you own is the key one. Quishing works because users can't see where a sticker leads. On the defense side, the landing domains behind malicious QR codes are usually new, so phishing domain feeds with first_seen dates catch many of them early (e.g. whoisfreaks.com/products/threat-intelligence-feed).