Is the QR Code applied professionally to the surface, possibly behind some security feature such as glass or another surface finish? Is the menu on the table in the general style of the restaurant, or does it look off or entirely different? Is the QR code applied on top of something else, possible another QR code?
Don’t use apps which directly open QR codes. Any sensible app will tell what the information is before processing it.
And at last, the simplest and most efficient security measure of all: Commonsense. Don’t scan everything you come across. Restaurant menu? Sure. Some random poster out in the woods promising a quick buck, happy time or their like? Hard pass.