The NFT is the token, not the metadata. Of course there are projects with on chain metadata, and projects with on chain art as well. Also, many folks use IPFS pinning, so that does add some level of resilience as well, but yes not all NFTs are created equal.

IPFS pinning is only meaningful so long as a node keeps the item pinned. IPFS is basically a CDN, it's not magic online storage forever. Once the last node pinning an NFT goes offline the NFT goes offline and the token is more worthless than before.

most projects don't have on chain art or metadata, so the token is essentially a link to someone else's machine... if that machine goes away all you have is a token that represents something that no longer exists

Yep, I think we are in agreement. It's a buyer beware kind of thing for collectors of NFTs to do their own diligence if they care about these details. I do love the on chain projects though and the budding generative art scene. For example how Art Blocks keeps their code on chain... it's a very creative use of the medium.