With that said, I went through some random NFTs the other day and I saw a lot of tokenURIs pointing to a plain metadata.json on a regular server that I could access in my browser.
Yikes. I've been meaning to do a survey & look at NFT rot, including number of pins on IPFS. Just because something is on IPFS doesn't mean it'll stick around
(enter 40913 at https://etherscan.io/token/0x2a46f2ffd99e19a89476e2f62270e0a... in tokenURI)
With that said, I went through some random NFTs the other day and I saw a lot of tokenURIs pointing to a plain metadata.json on a regular server that I could access in my browser.