How does an NFT really let somebody own something?

I have read up on NFTs recently and about how people can become the “owner” of an artwork. I’m new to it and there are a few things that I struggle to understand.

Many articles I have read describe how they would upload their digital artwork, usually their source file, to somewhere that has a download link to it. I’m assuming it’s either a Cloud storage or IPFS. And this download link to the source file is submitted together on Rarity when creating the token. When a buyer buys that token, he owns that artwork which is supposed to be referenced by that token and also gets access to the download link to its source file.

Now, what happens if one of the buyers in the chain of selling/reselling leaks that source file? Isn’t that token now pointless?

Also, when a buyer has bought that token and gotten access to the source file, he could have just downloaded it and then resell that token right away because he now owns that actual source file and owning that token isn’t valuable anymore, wouldn’t it? In fact, now that he has the download link already, he can download it again and again even after he has resold the token! If he is generous, he could share that download link with his friends too.

Or he could even use that source file to regenerate the artwork, change some colours and now call it his own work, create an NFT for it, and resell it as an original work again.

Lastly, when submitting the link to download the source file of the artwork on Rarity, is that download link stored within the token that can only be decrypted by the owner’s private key in order to reveal the download link? Or is that download link simply stored on Rarity’s database and referenced by the NFT? If the download link was stored on Rarity’s database, what validation and value does my token even have if Rarity happens to close down one day and access to that link is gone together?