Bad guy idea: Stick your man-in-the-middle QR code over the restaurant's QR code sticker on the table. Use the same design. Pay thru the app. Mine credit cards! It'll probably only work once, though, because someone will say like "Hey where's my salted milksteak?" and the server will say it wasn't ordered. A fight will ensue and all moneys will be lost.
No, you're thinking too small - do it on companies that HAVE online ordering via the QR code, and tack on "fees" and still place the order through - could even hire contractors to do the actual orders.
People might not even notice, just like they don't notice the "18% gratuity included on all orders" that are appearing here and there (and still tip on top of that).
Friends, if we were all evil, this would work seamlessly.
The only outstanding item: what do we name the fee? Keep in mind names already taken are service fee, small order fee, heavy order fee, pickup fee + dropoff fee, Chicago fee (regardless of city), and the anti-fee "customer happiness refund".