The only proof is of ownership, regardless if it was stolen or bought.
So I see no issue here.
Precisely. I thought blockchain was explicitly supposed to prevent this?
I mean, yes, if the only copy of your wallet private key is on an unconnected USB stick or something, and you never trade with it. Then there's theoretically no way to steal it.
That's generally the story with blockchains. All the guarantees and desirable properties vanish in practice when you try to do anything useful at scale.
That doesn't work if you give control to a third party. This is a defect in the implementation of a centralized market place.