Identifying this should be relatively easy in the core libraries; finding alternate valid QR codes using "less optimal" grids.

Of course the API confusion here becomes non-trivial, which hampers securing against it. And with existing libraries being widespread, its going to linger as an attack for a long time.