Yep. Definitely shows opportunities for getting value out of zero-day exploits next Superbowl. If you can find a straightforward-to-monetize attack that works on either of latest iPhone or Android, I'd imagine it would be easy to cover the cost of running the ad. And behaviorally, I have to assume that folks would consider a QR code on their TV a more "trusted source" than, say, an unsolicited e-mail, so you can probably even get some behavioral co-operation.
