Installing an APK from the browser is not the only way to install a spyware on your phone within 1 minute. If the person is determined to spy on you, it can be done.
The steps to allow install Apps from unknown sources described are related to Android versions 7.X or lower. Which means that your phone does not have the security updates since 2017. Since, ...
Even quicker scenario: a USB rubber ducky or similar could be plugged into the device's USB port. The attacker does not need to interact with the screen at all if the phone is unlocked and the device is programmed correctly, as the device will simulate an auto-typing keyboard.
Alternatively, and similar to the QR code method, an NFC tag could be placed near ...
Is this possible in 1 minute?
It's not impossible:
Open Camera and point to a QR-Code. 10 seconds
Open browser and download the APK file. Depending on the file size, it can take 20 seconds or less.
Open the APK, if you installed anything from the browser before, no confirmation is needed. Depends on the APK size too, but can be done in 5 to 10 seconds.
Often antivirus programs trigger a false alarm that a certain file is
corrupted or infected.
You say often antivirus programs triggers a false alarm. You said correct answer by yourself already. In fact, how you feel is correct. Anti Virus software triggers false alarm (aka false positive) frequently. That is probably how most of us feel.
My question is ...