" that URL often just points to some VPS running Apache somewhere. Anyone with access to that machine, anyone who buys that domain name in the future, or anyone who compromises that machine can change the image, title, description, etc for the NFT to whatever they’d like at any time (regardless of whether or not they “own” the token). "

This is how I felt when I first created a NFT. Man, the contract is so secure and all that but the raw asset - forget about it.

https://twitter.com/pbanavara/status/1457675453565599748?s=2...

What I deduced was that the chain will somehow reject any other contract referencing the duplicate asset and only preserve the original contract. Something similar happened on OpenSea with Moxie but isn't this centralisation ?

But doesn't this apply to all off chain assets ? Essentially any underlying data for a smart contract, because you know storing even a byte of data on chain costs a lot.

So the smart contract - essentially a set of instructions is distributed, decentralised but prone to security lapses ( a whole another story ) yet somehow the data for these smart contracts is centralised ?

I am so confused.