It is pretty easy to imagine a world where all manufactured hardware is compromised by default so that the state can access it. In some ways were close to that already. That said, you're point is good. The dedicated person can probably achieve pretty good privacy except in the most powerful regimes.
Even that wouldn't stop the most dedicated, which are most likely exactly the ones you're trying to stop.
As long as embedded devices exist, you can write a QR reader/writer + encryptor/decryptor on an embedded device with a camera/display, and use the compromised devices as just a transport layer for encrypted QR coded messages.
