I can mention that GE does something very similar. Yea, there are some details that are a bit different, like the GE app uses the camera to read a bar code located on the GE Connect module, instead of a QR code. But I think overall, it going thru the same actions.
One difference is that the GE doesn't try to hide what it is doing. It tells you that is temporarily disconnecting from your home WiFi network. It tells you it is connecting to the GE Connect module. Matter of fact, if it fails to connect, it will prompt you to manually look for a local WiFi network called GE-serialnumber and have your phone connect to it, and then proceed/continue with the rest of the setup. Of course, once it is all setup, you'll never see the GE-serialnumber network again.
I have done this for a couple of different GE Connect modules (different GE appliances), and never had a problem with the Security app. So, IMHO, it is possible, and that's the point I am making here.
BTW, this morning I was talking with a good friend, and he had similar problems but with the AT&T version of some security app (EDIT: Lookout?). He couldn't even complete the CM100 setup using his phone. His solution was to use a tablet, he also has, for the setup, and is now OK.