YOU could perhaps, but your average target hasn't much of a clue what a VM is, let alone how to set one up.
And keep in mind, malicious software is going to be challenging, and there are much more clever ways to use QR codes.
E.g., imagine some store that has QR codes on the product aisles to access information on a product via a URL. I make a fake website that spoofs the legit product page, but offers the user a special "Buy online and save 25%" offer, which of course they are very tempted by due to the steep discount.
And keep in mind, malicious software is going to be challenging, and there are much more clever ways to use QR codes.
E.g., imagine some store that has QR codes on the product aisles to access information on a product via a URL. I make a fake website that spoofs the legit product page, but offers the user a special "Buy online and save 25%" offer, which of course they are very tempted by due to the steep discount.