Nayuki explains the creation side of QR codes very well, including the selection of the mask.
https://www.nayuki.io/page/creating-a-qr-code-step-by-step
It is not only the ECC area that is malleable, the entire code is. Actually, *before* a QR reader starts decoding the content, it checks for (and fixes) errors in the content with help of the ECC bits.
So, a malicious user could create a code which a human would decode differently from a computer…
@marcel @cybeardjm @blinry @piko Superb. Thank you!