CryptoPunks are a special case NFT, since they were created before "NFT" was even a used term. The Ethereum blockchain stores owns each Cryptopunk. However, the images are not stored there, neither is a pointer or link to the images. They live at this link in one giant file, also shown below. Stored on the blockchain is a hash of this image. That means if LarvaLabs, the owner of that link, changes the image, everyone will know that it changed! But a hash isn't enough information to know what the image looks like, so from looking at the CryptoPunks smart contract alone, you can't know what the images are. You just have to know where this image is to know what you own.
Years later, LarvaLabs actually did publish the Punks images to the blockchain. The Ethereum blockchain isn't good at storing large files, so this was only possible because the images are low resolution by design, and by using clever compression. It still cost $264 to publish them. And since contracts are immutable, the original CryptoPunks contract has no reference to the new contract.