There is a proposed spec to have files stored on relays (relays are servers too) but its not something most devs/relay operators want because it introduces legal liability.
The text containing the URL link to some image host is stored as text.
the image is rendered through the client because it recognizes the link as an image or video. If you dont own the server, then yeah the image can be modified or deleted. Nostr.build is a service to upload your media to. They can still modify your media but nostr:npub137c5pd8gmhhe0njtsgwjgunc5xjr2vmzvglkgqs5sjeh972gqqxqjak37w is a nice dog! I trust him to be responsible with my files 🥰🐕🫂🫶 and not eat them like my homework or lunch 📓😭😖🍖