The system is designed in such a way neither of these can happen. Once you have your card saved on your device or printed all the data needed is encoded into the QR code. The app that the business will use to verify your data is a different app that can scan that QR code that should not require the need for an internet connection. The data is signed with a certificate, likely the same certificates used by your web browser to ensure the data in the page is coming from a trusted source. Without the private key used to generate these QR codes (which only the government has) you could never fake one of these QR codes.

Even if it was possible to generate a fake QR code with the required signature it would violate the terms of service of the app stores requiring users to sideload the app which is only possible on android phones and will be tricky for most users.

(White paper on the underlying technology)[https://spec.smarthealth.cards/]