The menu doesn't ask for payment typically, the server still does that so a qr substitution attack would do nothing useful other than confuse the customers and staff for about 10 minutes before they decide to just rewrite the menu on some paper and deal with the problem after closing.
In Australia, QR code to website menu->order->pay has become the norm; restaurants without it are increasingly rare[1]. There are 2 or 3 major vendors of such systems, generally respectable (though a few dark patterns on some of them). I'm completely surprised there haven't been substitution attacks already.
[1] These emerged during/after lockdowns to minimise staff contact with diners, but have stuck around as there's an employment crisis whereby restaurants (and plenty of other businesses) can't find staff, so this reduces the need for staff to stand around waiting for you to place your order.
Sure, I haven’t described the universe of QR code usage at restaurants. The point still stands that a QR code at a table is an abusable trust boundary in some places where it’s used.
