The thing that really bugs me about QR codes in correspondence is that I can't immediately tell if PII is embedded in it.

So I always assume they're sensitive and shred them.