Technically even the token isn't directly blockchain-backed. ERC-721 (the base standard) only requires a URI to a metadata file. That file may contain a link to the asset (JPG or whatever). So there are 2 indirections. Hopefully both are IPFS addresses.

Of course, there are other NFT implementations that store metadata directly in the smart contract, but that requires a lot more gas.