Out of curiosity I dug into how NFT's actually reference the media you're "buying" and my eyebrows are now orbiting the moon

Short version:

The NFT token you bought either points to a URL on the internet, or an IPFS hash. In most circumstances it references an IPFS gateway on the internet run by the startup you bought the NFT from.

Oh, and that URL is not the media. That URL is a JSON metadata file

Here's an example. This artwork is by Beeple and sold via Nifty:

https://t.co/TlJKH8kAew

The NFT token is for this JSON file hosted directly on Nifty's servers:

https://t.co/GQUaCnObvX

THAT file refers to the actual media you just "bought". Which in this case is hosted via a @cloudinary CDN, served by Nifty's servers again.

So if Nifty goes bust, your token is now worthless. It refers to nothing. This can't be changed.

"But you said some use IPFS!"

Let's look at the $65m Beeple, sold by Christies. Fancy.

https://t.co/1G9nCAdetk

That NFT token refers directly to an IPFS hash (https://t.co/QUdtdgtssH). We can take that IPFS hash and fetch the JSON metadata using a public gateway:

https://t.co/CoML7psBhF