As far as I know, CasaOS (same as Cockpit) is installed on top of a default OS install, so you could always access the OS directly to install/configure things outside of it, if the need arises.

I would not say you would be held back by it, if it does what you need. And for what I can see online, you can install any docker container even if it’s not on the default catalog of CasaOS, or access the OS.

If you want to grow your knowledge of how things work, or how to deploy services without CasaOS, you can always do so in parallel of using CasaOS, so I don’t see where the issue could be.

adding Quillpad, as another alternative

QR is just image to text, most QR reading apps I have used, show you the QR content before going to the website (or let you disable opening the link directly) so you should be able to check the URL or content and see if the link is legit or not.

But let’s be honest most people don’t know or don’t even bother and that’s the real problem.