Yeah nothing is locked to OAuth, an SQRL implementation is feasible using our current interfaces.
The QR code generation may require a fair bit of custom code client side, and the notification logic so all the magic works.
I would say this is reasonably high complexity work given you will be starting from a blank slate with a spec only.