In general, ownership of an NFT is enforced by the smart contract, not IPFS or a server. Nowadays, most NFTs are links to an image, and a popular way to link to this image is via an IPFS CID. If you use a centralized service for this storage part, you may use additional protection measures (password, etc). Of course, the point is to have a decentralized asset, so it is often on IPFS. Then, anybody with the CID can access the file. So the only option I know to protect your file/image is to encrypt it and require people wanting to display it to provide a piece of information known to them only (password, wallet key, etc).
That being said, almost all the images representing an art NFT and which IPFS CID is publicly displayed on smart contract are non-encrypted. So they are not protected at all. In fact, not only can I see almost all the NFTs thanks to their CID, but I have the list readily available on the Ethereum blockchain.
So basically, the smart contract says: “Everybody can download this image at this address in an uncensorable way, make it their wallpaper, share it with friend, make it a meme, mint a new NFT by changing a pixel, or do with it whatever you can normally do with an image, but just remember that this guy over here paid for this ad. Also, it is ‘theirs’, so please don’t do any of the things listed previously, coz they paid .2M$ for it. Thanks.”
I see no way to use art NFTs (meaning paying an artist for a digital piece of art, then publicly displaying on a blockchain the fact that you paid for it, how much, and where anyone can download it for free) as anything else than art patronage in favor of the artist.
If you figure it out, please ping me.
NB: NFTs can have a lot of useful use cases. The craze for the main current use-case (buying a now-public digital image/video) is beyond me.
Anyway, protecting the record that you have paid for the asset is done in the smart contract. Protecting against access to the thing is done by centralization (defeating the point), or by encryption. Either way, IPFS is not the place where this takes place.