At least for WhatsApp and Signal, it appears the user is required to open the messenger app, navigate to the linking setting, authenticate themselves, and scan the QR code on the device that is to be linked (or one that corresponds to it, but hiding in a malicious e-mail). I can't find any flow that allows for a QR code to link directly to the authentication mechanism, and provide the authentication code to it, while bypassing user authentication.