This is only true for some NFT's. There are some NFT's that exist on the web server with authentication on the blockchain as you say. This is done because of the space on the blockchain that is taken up. However, this is not the case for all NFT's and varies on the chain the NFT was created on.
