The QR code contains the key used for HOTP or TOTP, so it must be kept secret. If someone gets a picture of your QR code when you're setting up your authenticator, they'll have the key and will be able to generate valid 2FA codes.
The reason this is more secure than SMS is because it's encrypted in-transit by TLS, whereas with SMS it's been publicized many times how it can be intercepted. This prevents remote attackers from getting the QR code, but you are still responsible for keeping it secret from anyone around you (ie you shouldn't set up your authenticator in a public area).
You can read a bit more about how HOTP/TOTP apps work here.