The QR code/UUID is only used during installation
The QR code/UUID is only used during installation. After that the device has a 15-bit local ID, and a network key which was distributed securely during installation. Messages are signed and encrypted using that key. Up to 32k devices can share a network key and so interwork without additional bridging or gateway sorts of things.
So you can't control your neighbour's lights.
The QR code is used to handle the race condition when you and your neighbour are both installing a new light bulb at the same time - to keep you from accidentally acquiring control of each other's. And so you can tell which of your several exciting new devices is which as you give them IDs and set them up.
Group IDs are also 15-bit; each device can also belong to multiple groups and so respond to commands addressed to eg. "all kitchen lights" "all lights" "downstairs" &c &c. So long as they share the same network key.
The reportage about 64k groups each containing 64k devices, making 4bn, is, um, confused. With separate network keys, there can be billions of distinct mesh networks worldwide, each with up to 32k devices, without them interfering with one another.
Aside: the "advertising channels" name has nothing to do with pushing marketing messages, though many companies are looking at doing indoor location/proximity via BLE ads, and then layering push messaging on top of that using a separate server connection made by the supermarket-loyalty-card-app or equivalent.