I don't know much about this new captcha system, but I feel like the challenge wouldn't really be in the scanning of the qr code itself but more so on making the device you're scanning with seem legitimate. They could check usage patterns, what apps are installed, how many accounts are added and are they actively used, location and sensor data, are the hardware specifications really unusual, are they constantly trying to complete random captchas... Stuff like that to tell apart a real user's device from a bot or sandbox. The QR Code is probably just a random ID for which captcha instance the user is trying to pass.

Also I just realised this but this is probably inconvenient as hell. Like I do NOT want to constantly be picking up my phone to scan QR codes when I'm trying to go around the Internet. What if my phone is on the other side of the house? I don't want to get up and walk all the way over there! If this gets fully rolled out there may actually be a small dip on the amount of desktop users of websites because they just leave when they are hit wth this captcha instead of bothering to scan a code.