What you are saying is that an certificate of authenticity is useless because you can burn the artwork with a torch. Those two things are mostly unrelated.
I say the certificate of authenticity can be easily forged or destroyed with no way to know what it once contained. And because the entire reason to exist of an NFT is based on this certificate of authenticity (unlike a real world artwork which can be touched and estimated by a specialist), I see a problem right there. Of course this is a problem only if the NFT has an artistic value, which is an entire discussion per se.
But you can't really touch the certificate (the blockchain entry), only the "artwork" behind it (png stored on digitalocean).
What is and isn't art and artistic value, and whether an indistinguishable copy of the mona lisa should be valued the same is an entire discussion, yes, but it isn't tied to NFT-s. By the way when I say indistinguishable I don't neccessarily mean by world class experts, but for example my guests who happen to spot my (hypothetical) fake mona lisa in my living room.
We may have differing concepts of what a certificate of authenticity is. To me, the certificate of authenticity is what guarantees that it can't be copied. That is the NFT with the uri that lives on the blockchain.
You are right, it cannot be copied, and the URI lives on the blockchain. But the resource pointed by that URI does not. So the server doing the redirection via that JSON can redirect to whatever else, because even in the JSON we only have the asset URI, and a blockchain navigator can only check whether the JSON is according to the schema. So yes, nobody can steal your NFT, but your NFT might tomorrow be instead of a Beeple, a picture of my cat. Rickrolling on a whole new level.
The recommended way to handle this is to use a URI which uniquely identifies the content, such as an IPFS address. Then, while the data is still stored outside the blockchain, anyone who has a copy can trivially prove that it's authentic and you aren't reliant on a particular server. (Just make sure you save/pin a copy of the file on your own system so it doesn't disappear.)
I would agree that an NFT pointing at some plain HTTP(S) URL on some random server without so much as a hash to identify the original content is pretty much worthless.
