The metadata is an IPFS hash in most cases that you can use to validate against the file regardless of where the file is stored. At any rate NFT market places are working on surfacing quality data to users to show them this information. Some NFTs are small enough to be embedded on-chain. Some use IPFS + Filecoin or other decentralized archive service like Arweave. Some don't. Surfacing that to users will become more important as the space evolves.
The metadata only contains an URI to where the actual information lies (says ERC-721). So as long the URI stays, the hash stays. And then you go and modify the contents of the pointed file and lo, instead of a Picasso you own now a lolcat. Or the file gets simply removed because the hoster went bankrupt or lost the backups after a crash and you're left owning... yeah.
