If your threat model assumes an attacker can promptly recover the private key from the public key then once the user broadcasts his transaction spending both the old output and his own QR output the attacker could simply create his own QR output and RBF the honest transaction.

correct. this doesn't provide protection. and any such rule about "spent along with" would be a hard fork. which is fine if qr ever matters (there's still not a lot of evidence that it will).