None of that is necessary because you are not exposing anything to the internet. We are still talking about local sharing. Android does not have a firewall so there really is nothing to configure. But if you think it cannot be possible, try it for yourself.
All your traffic can now be captured. DNS requests will be logged. Some traffic might be redirected. When will the connection be closed? What if someone shows you a different QR code, and you're not that tech-savvy. For example a phishing webpage which asks for the user's password. Many many many people will still just enter their single-password-for-everything.
What if the QR code is a deeplink to an app.. for example to a conversation on or whatever. Or maybe someone was previously logged in into some account.
