This is a topic that my union recently addressed, because it turns out that most companies do not have a policy on how to handle sorrow, and this often results in a less than ideal situation for both the employee, employer and coworkers.
Sorrow is comparable to and often leads to stress. Having all the coworkers individually send flowers, showing secondhand sympathy, acting weird about it and themselves having to tell the story over and over does not help on the stress. It might even affect other coworkers too, who might have experienced losses too, triggering their issues over and over again. The result is that the entire work place is in a state of sorrow where they either tip toe around the topic or constantly brings it up. This is very unlikely to be what the person needs. It’s very different what kind of attention each person wants. Some people like to keep working as usual, using the work as a distraction or safe space from the mourning process all together. In a situation like this, it is nice to know that they are needed. Removing their workload could be a bears favour. Nobody wants get told that someone else did your job. It’s basically giving them either an existential threat or a burden of bad consciousness, because then who has to do those tasks and for how long.
All of this shows that even the best intentions can easily lead to more sick days or resignations throughout the entire company if the sorrow of one person is mismanaged. The right way is for the company to have a guideline or politic on who does what. The management must take the dialogue of which tasks can or should be handed over in what time frame, who informs the other employees of the death, the distribution of work, and on behalf of the individual: how they want to be treated on their work place.
Leaving it up to everyone is a recipe for disaster.
In your case, in short: At least make an effort to coordinate any gifts with the rest of your coworkers, so that the person in sorrow does not have to address you all individually and to avoid any other coworkers being left out or creating social groupings etc.
The largest QR code can hold up to 3 kb of data, which is more than enough to write a nasty virus in an injectable script if aimed at specific devices/apps. The main hurdle is breaking the app to execute the code instead of treating it as a string. It’s the Drop Bobby Tables joke. Developers hopefully don’t fall for this anymore.
Anyway. Making a shitty link and leading people there isn’t a new idea. You don’t even need a t-shirt. Hackers already place their own printed QR labels on top of otherwise real codes, and the user might not even notice, because they’ll be redirected to the right site after the dirty deed is done dirt cheap.