A photographed or saved QR can still be scanned by anyone who has it — no printed/on-screen code can be made truly uncopyable. Turning this on means a scan only succeeds when the phone's GPS is within range of the workplace, so a photo taken off-site won't work for punching in/out. It's an extra layer, not an absolute guarantee (a spoofed GPS or an in-person handoff of someone else's QR image can still get around it).