A QR code hides its destination until you scan it
That is the entire reason they get abused. A sticker over the code on a parking meter, a payment request in an email, a code on a leaflet pushed through the door - the pattern gives no clue where it goes, and most phone cameras respond to one by offering to open the link immediately, which means the decision to visit is made before anyone has read the address.
This scanner shows the decoded string and stops. If the content looks like a link it is presented as text with the address visible, and opening it is a separate deliberate action. Reading the domain before you visit it is the whole defence, and it only works if something puts the domain in front of you first.
Decoding locally, and what that costs
The camera feed is rendered into a video element and read frame by frame by the barcode detector built into the browser itself. No decoding library is downloaded, no frame is sent anywhere, and the camera stops the moment a code is found or you leave the page. For a code on a document you would rather not hand to anyone, that is the difference that matters.
The cost is that the browser API is not universal. Chrome and Edge have it on desktop and Android; Safari and Firefox do not, and on those browsers this page says so rather than quietly failing. Shipping a few hundred kilobytes of decoder to every visitor so that a minority get a camera scan was the alternative, and it was not worth it.
Scanning a picture of a code
Often the code is not in front of you - it is in a screenshot, a PDF page someone sent, or a photo of a poster. The file picker handles those the same way as the camera: the image is decoded by the browser and never uploaded, and a file that turns out not to be an image at all is named as what it actually is rather than rejected with a shrug.
This is also the case where the ZXing decoder earns its keep. If a symbol is damaged, unusually encoded or simply refuses to read, its report of the raw bytes and error correction level tells you why, and nothing here does.