With QR codes you can scan them with your phone and see what they actually say before allowing an official wallet to process the data... except this one time when I bought my COBO wallet and learned that the supposedly public signed data was ENCRYPTED and then found out the company was based in Honk Kong. Super neat.

As for Coldcard... did I remember to mention it's not even open source?
Technically anyone can look at the code but they aren't legally allowed to use it.
This somewhat defeats the purpose because why would anyone look for a flaw in the code if they aren't even allowed to use that code. The only people who now have an incentive are the bad actors.