If the person/entity minting them commits to only using a particular address/public-key when minting (such that only ones from that address would be regarded as legitimate), then one can still check all the transactions they’ve made, and,
well, if they mint tokens for other files which you don’t know what those files are, and have no way to retrieve them, then yes, you could be uncertain as to whether or not those are essentially the same image but with some noise added.
If there is a list of what all those files are though (maybe the files are all available for download on the author’s website? Doesn’t have to be the author’s, just any source providing each file. Doesn’t need to be a trusted source either.), you could check that none of them are essentially the same.
Though, the reliance on all the images being publicly available, does go against what it seems like the way many seem to want to use NFTs,
and so for the use cases which are completely incompatible with all the images being publicly available (e.g. people who want to be the only person who has access to an image), your point is entirely valid, and there is presumably no way to achieve the use-case that those people seem to want.
As for “what about on other technologies” I think this fits under the “the author should just make well-known all the [address+chain combos] they issue from, and instruct people to treat as illegitimate any which is issued from a [chain+address combo] that is outside of this well-known list as illegitimate” thing.
It doesn’t seem like that serious of an issue?
That being said, I don’t see much point to tokens like these. I’m just talking about "what can be done under different goals + assumptions" .