if you try to copy a token you will end up with a new cryptographic hash and a new history of transactions associated with it. there are countless clones of crypto punks for example, but the only one that has any real traction is the one that has a clear history of transactions associated with its contract hash. anybody who can tell the difference between two strings of characters can detect whether a token is a forgery or not, it does not take an expert.
yes obviously centralized exchanges are centralized, they are not the ones upholding the ledger or crypto art certs. even crypto art platforms like Foundation and opensea do not own or uphold the certs being issued and indexed by their platforms. it is more like the way that google indexes search results, it doesn't own the websites on its search results.
yes impersonation is possible but often easy to detect on-chain. if a supposed notable artist is suddenly minting new work from a public key different than the address they've used in the last two years, suspicion would be warranted.