The real threat model here isn't the base64 payload, it's Uniqlo turning a T-shirt into a QR code that requires a human OCR pipeline to redeem.