"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if it indexes text in images for Spotlight the way Google has already done in Drive for years.
But I wouldn't be surprised if it fetches URL's in QR codes in order to index the title text associated with the URL for Spotlight. It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. Or, if it's just a shared "preview" library used across thumbnails and iMessage.
I'm not sure what to think about it. Previews, smart text, showing URL information on hover, prefetching, indexing, etc. -- it's all pretty standard stuff. On the other hand, it does feel a little weird for previews on a local filesystem to query the internet -- we're totally used to it in e-mail and messaging though. But, I used to keep bookmarks as URL (.url) files. It would seem natural for a thumbnail of the page to show up in Finder (though I don't think it does this?).
As for it being an "attack" to get someone's IP -- seems like that ship has long since sailed, as it's common for any messaging and e-mail client to already show previews. If you need to protect yourself against all of those, you pretty much need to figure out what level of Little Snitch or turning off internet or airgapping is required for your security concerns.
But I wouldn't be surprised if it fetches URL's in QR codes in order to index the title text associated with the URL for Spotlight. It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. Or, if it's just a shared "preview" library used across thumbnails and iMessage.
I'm not sure what to think about it. Previews, smart text, showing URL information on hover, prefetching, indexing, etc. -- it's all pretty standard stuff. On the other hand, it does feel a little weird for previews on a local filesystem to query the internet -- we're totally used to it in e-mail and messaging though. But, I used to keep bookmarks as URL (.url) files. It would seem natural for a thumbnail of the page to show up in Finder (though I don't think it does this?).
As for it being an "attack" to get someone's IP -- seems like that ship has long since sailed, as it's common for any messaging and e-mail client to already show previews. If you need to protect yourself against all of those, you pretty much need to figure out what level of Little Snitch or turning off internet or airgapping is required for your security concerns.