The QR code is displayed on the unsecure connected computer. Your phone network is used to perform the login, so it very little data.

A logical next step would be an app that can streamline the auth a bit (have your username prefilled from the Android account) and send the auth to Google via SMS (often easier and cheaper than getting started with dataroaming).