A scam image matches when its hash is close enough to a reviewed one; halves and quarters are hashed too, so a collage still matches. A QR code that contains a Discord login link is the classic account takeover: scanning it logs the attacker in as you, which is why Recommended deletes the message and times the author out. Any other QR link runs through the same threat lists as a posted link.
Example
/setup › Find a setting › Discord login QR codes