This is true. Many NFTs (not all) rely on trusting some random server. People are doing it, but it doesn't make it right. It's a bad business practice.

There are enough reliable methods to not rely on trusting some random server, but some money hungry developers cannot be asked to implement them.

Similar to how some websites do silly things, like storing plain-text passwords in their databases. People do it, but it doesn't make it right.