I would expect the biggest win for this campaign to be in the very beginning when the novelty attracts people.
I don't think this would be sustainable, because the QR code sculptures would require continual adjustment throughout the year to account for the procession of the sun. And clouds.
The angle will vary by season, but if it is legible for an hour a day, there is a fair degree of slop available.
It should be intuitively human adjustable, simply maximize the square pixelation nature, or if you want something more explicit, make the bottoms of the long vertical dark spots line up with adjacent short vertical dark spots.
It is near June and they appear to be vertical. In the winter, with a lower sun, it will need to be tipped down and people will need to hold their phones lower and perhaps come closer. Good thing they didn't build it like this for winter. Then in the summer people would have to sit on a friend's shoulders to take the pictures.
Yeah, so they pretty much come out and say it's a PR move. And is workable, apparently. As for the issues you suggest:
> The sun changes positions throughout the year
So does the sculpture.
Fast, asynchronous delivery is part of the puzzle. Waiting around for amazon deliveries is a pain; but for low-value groceries, the risk of theft isn't as serious. It works OK for newspaper deliveries, and when I was a kid we had milk deliveries left outside the door with no problems (yes, horse-drawn).
Like people have said though, this probably isn't as maintainable as a UV-sensitive one might have been.
Then you can figure out different patterns which are valid when lit from a particular direction, as well as altering the actual data it encodes, synchronised with updating the coupon code that merchants will accept.
Could be kinda pricey for that number of actuators though, but if you were willing to have very slow update frequency, a single 2-axis adjustment head (think plotter or laser-cutter) with a smaller number of push/pull elements could move around, changing only X pins at a time, maybe with a friction lock to stop them moving once it progresses onto the next group.
My test conditions were transferring them to a black t-shirt with an iron-on printer sheet, and then taking a jpeg of my wife wearing it in the kitchen with an iphone and using a QR code recoder app.
or just bookmark the url and open it again next day without scanning the statue again.
It looks like the QR "statue" pivots to correct for the changing path of the sun across the sky, but the positioning doesn't have to be accurate to the point of working exactly from 12:00:00 to 13:00:00 local time. You can also add enforcement on the web server.
This isn't really about being secure - it's about clever marketing. And it definitely succeeds at that.