NFTs are pointers, links to other things. Similar to the QR code, which is basically a link, but in here its linking a specific, unique Blockhain address with some real or virtual world stuff.

What we are doing in here is replacing a sensitive digital asset with a non-sensitive equivalent (token) that shows no extrinsic or exploitable value. The token works as a reference that points uniquely to the original asset through a secure system that should be validated.

This is why technically, an NFT is just an entry in a database decentralized. But conceptually an NFT is an abstraction with several layers: the id of the smart contract, then the metadata (who minted owned. etc.) and then the image.