The most frustrating thing about them is that many restaurants don't have their own website, and simply host the PDF on some third-party website, often through a URL shortener. So scanning a restaurant's QR code yields an obfuscated link that, when opened, immediately triggers a download of a PDF menu.
That's shady AF from a security perspective, and we should not be normalizing it.
Your intuition about the (in)security of PDFs is outdated. 2000s era Adobe Reader on Windows XP may have been a security nightmare, but a modern PDF app running on a mobile phone OS with bulit-in application sandboxing and a fine-grained permissions system definitely isn't.
It's less about PDFs specifically and more about normalizing the behavior where people just scan QR codes off stickers and then download and execute whatever arbitrary file the page wants to serve them.
It should be (and, for the most part, is, modulo occasional 0-days) safe for regular users to visit random urls on their mobile phones, even if they trigger a download. If that isn't the case, we have failed as developers.
After reading these comments I am very grateful that I have never seen any of this garbage. The main places here that use the QR menus are those reinvented food courts (don't know the hip new name). With those you order through the website, it texts you when the food is ready, and you go pick it up. Some of them make you pay at the website and other you pay when you pickup. The advantage is that that you get to spend more time together at the table socializing rather than dispersed standing in line at various restaurant stalls. The downside of course is that you then get text spams after leaving.
How do those PDF menus even work? Do they have a waiter come around and take your order? Do you order up front and the QR menu is just a convenience in addition to a large menu sign?
Depends on the chain. At one restaurant, the waiter still came to your table to take the order.
At another, the restaurant's entire menu was online and expected you to place the order through the website so that it was nearly indistinguishable from a carry-out/DoorDash order. The only difference was that you specified a table number in the order if you were dining in.
The most frustrating thing about them is that many restaurants don't have their own website, and simply host the PDF on some third-party website, often through a URL shortener. So scanning a restaurant's QR code yields an obfuscated link that, when opened, immediately triggers a download of a PDF menu.
That's shady AF from a security perspective, and we should not be normalizing it.