You do misunderstand. You do not own the item, you own ACCESS to the item.
This is the thing. It's a Non Fungible Token. Non Fungible. More than unique, it is also unchangeable. - forever. That is the ramification of the "non fungible" part.
Again, it is not a URL being protected. It is a non-fungible token. A 301 redirect would just update the http service application trying to use the token. Don't authenticate, no access. Don't have even the right URI, no access. Using a VPN? No access. That and more can be enforced, no idea if it all is in every service, but I mean you wouldn't want to use a service that doesn't.
Unfortunately, yes it is a thing, but it is almost easy to tell when it happens... If you bother to look. We have AI's and database queries that can detect it but, not everyone is good at writing that kind of stuff.. or writing updates when a new vulnerability is detected.
Also remember my perspective is NFT is interesting, but the use cases of it are so far questionable.