I'm still a bit hazy on all this as well but I think that's the idea?

The NFT itself is basically some payload (any collection of bytes), a checksum of that payload, and some metadata. What's to stop someone from perturbing the payload by one byte and minting a second NFT? Nothing, really, other than "it's not the first". So yeah it's down to performing due diligence on the vendor and payload to make sure you aren't being snookered.

I think. I get the whole crypto aspect. I don't get the social/contract aspects.