Yeah probably, I haven't seen in depth yet how it works, just a "label" for non-technical users...
I saw from the gitHub repo that HBC works even without a SD inserted in the 3DS, which means that the QR must contain the executable code and maybe a ROP toolchain for the exec, am I wrong?