What Android does is slightly more complicated than that, but it's good to know Apple supports at least something standardized. The main advantage of DPP/EasyConnect (what Android uses with QR codes) is that the key isn't actually stored in the code. It creates a temporary key that allows both devices to communicate securely, then transfers the credentials securely over that connection.
The key is only useful to the first device that gets it. It's generated for each transaction and only valid once. The devices (let's say two phones) communicate directly and once that's done, the connection closes. To add another device, the phone weill generate a new key and a new QR code.
