I agree on this, that said witness data can be malleable, so we usually need to anchor it on-chain with a hash if it is needed for future usage. Additionally, currently there is no long term incentive for the long term availability of Witness data.
Just one curiosity, what prevents a third party from copying also this QR code pixel-by-pixel?
Love & Peace, Phroi