I've made one popular addon for Garry's Mod that lets you create custom avatars. It's a bit like a game engine where you have a scene graph with different types of objects you can add to your default avatar or override completely. The modifications can be "worn" while playing on a server so all the other players can see it.
There's also a market to sell and create these avatars.
If you have access to run Lua on the client (which is by default turned off) you can easily steal avatars by poking around in the Lua client state. There's a big demand from the community to make this more difficult.
For reasons due to how the addon is designed as an WYSIWYG editor and all of this being Lua I don't think it's feasible to obfuscate avatars that are worn. The only solution that seems to work for those who are worried is to have a whitelist/blacklist system that decides which other players can see your worn avatars. Of course that won't stop malicious servers from snooping on the network traffic, but these people are skeptical of wearing their avatars in servers they don't trust.
Personally I'm a huge advocate for free software and I always encourage people to share their avatars, or at least parts of them so that other players can learn how to make things. I also made many myself that are public.
That's certainly an interesting way to police copyright violations. It's funny how the communities you describe might have foreshadowed NFTs. What I wonder is, do people no longer view these item as... just data?
I don't feel remotely old enough to use that phrase, but "back in my days", we were proud that data is a new kind of thing that can't be locked up or limited the way physical items can. I wrote little scripts to extract sprites from game files all the time. A "right-clicker", as you might say, only that little actual clicking was involved.
I still can't wrap my head around the fact that there are now "underground" communities who will happily do the exact opposite.
There's more of a worry if the data is more like instructions on how to create the particular piece of art. For instance a compiled blender model vs the blender project.
It's somewhat understandable that there's a need to protect the "how it was made" when it comes to art. For example if a musical artist creates a unique song that also becomes a hit, others will try to copy the sound of the song to get a ride on the hype. If it's popular enough it will happen regardless but if the "source code" of the song is available, ie instructions on how to create the unique sound this will happen a lot faster. And over time what made the song so unique and interesting is no longer that.
I think Skrillex is a good example of this. Suddenly everyone was trying to do the wobble bass, initially failing a bit but eventually the community nailed the recipe and thus saturated his sound.
So I would say it's inevitable regardless if you have the instructions on how to do it. It's just that it might take a bit longer if you don't.
You can make your own gamemodes, or "addons" that work in any gamemode. The standard sandbox gamemode is typically extended with many addons.
Your question is a bit like asking what you can do on the internet. You can build a website or you can browse other websites. So in a way the garry's mod client is just a browser. On the hosting side you can very easily start a server and almost everything regarding custom content transfer is handled automatically.
Just like the web we've had many server exploits because they can execute lua on the client. We are now moving towards a permission based system on client to allow the server to execute things like programmatically opening external links, enabling the microphone, etc.
I wanted originally not to mention "the metaverse" here, but as far as I understand the idea of metaverse without VR, these games have been doing that long before metaverse was a thing.