Some NFTs point at images hosted in a traditional, centralized fashion. Others point to IPFS hashes which are basically permanent.

Pretty much.

And worse, the host of the image could theoretically change it on you and you'd have no way to prove (at least in a trustless way) what the original image was.

Yup. Here's a tool for checking most ETH based NFTs: https://checkmynft.com/?address=0x5c61afa47570ab2b562606fa57...

it depends on how it's implemented. its much harder to implement onchain so a lot of projects will do things like <a> tag which is not trustworthy long term like moxie said.

there are well respected projects that are fully onchain such as cryptopunks and autoglyphs