The base contract does not contain any info about the asset the NFT applies to and the metadata extension only allows you to store a name and a URI (which hopefully still works and still points to the object in the future). There is no object hash as far as I can tell.

Afaik there can be several NFTs for the same object (URI) and none of them is inherently more legitimate than the other. You'd need some kind of endorsement by tha artist to know which NFT is the "real" one. But I'm not an expert so please correct my if I'm wrong.

You are correct. Note that there can be multiple different URLs pointing to the same file. And note that multiple files (unique sequences of bytes) can represent the same object, say, a JPEG with slightly different compression ratio.

The point then is that neither the the url nor the hash matters. What matters is that the artist says "this NFT represents this work of mine". Everything else is just extra.