Thanks!
The QR code is password protected (only available when the Keychain extension is unlocked). Then it is scanned directly by the Keychain mobile APP and encrypted in there using your PIN and biometrics, it's a direct Keychain to Keychain transfer of data.