So it’s a matter of being relatively easy to scam people with it?

That is merely a side-effect of one of the original sins of programmable blockchains - the fact that there is a delegation of responsibility of data management from a database administrator to whoever happens to have control of that data, and the controller can only manage that data according to the underlying code of the NFT.

This only sounds appealing if you’ve never actually touched a database in your life. Making everybody their own database administrator is a terrible idea, and the only reason blockchains do it that way is because there’s no other sane way to write applications on a distributed, globally mutable database.