I use an app called Decoder to generate QR codes from text to share passwords from my PC to my phone.
The app in question is installed through flatpak, and using Flatseal I control the permissions further. Though the defaults are good enough. It has no network access but it has access to IPC and Wayland.
Are there any glaring security issues with doing this?
My understanding would be that, as long as flatpak's sandboxing works and flatseals permissions are in place, and the app isn't malicious, it should be fine. On the mobile end of things, I use GrapheneOS's default camera app using the QR code function. I have no reason to believe anything is saved on my phone once I close the camera app.