Even if you avoid malware, many QR-linked ROMs are garbage. Common issues include:

The rational answer is to avoid the QR code entirely. The game is available legally for less than the cost of a pizza. The official ports run on nearly every device imaginable. And in an age of ransomware and identity theft, the minor savings from piracy are dwarfed by the potential costs.