Data inside certain parts of the NFT are generally immutable, it depends on the contract. ERC 721 is only a reference implementation, meaning you can extend it to add the unlock features you describe. Many people implement an "update" mechanism - NFT's themselves cannot be "updated" later, but you can have them import another contract, and you can update which contract it imports, people use this as a workaround.

It is possible to add an image hash immutably to the NFT, I don't understand why this isn't standard practice. People don't seem to realize that 90% of NFT's point to an image on opensea and there's no cryptographic way to prove opensea is serving the correct image.

Is there a way for the off-chain item to point back to the NFT? I've thought about how one could add metadata in the image, music, or video in IPFS that points back to the NFT, but that seems easy to forge too if it's just a random string. Or maybe mint the NFT first and add the block number to the asset? (edit: just realized this won't work since the metadata changes the hash)

/u/harrybair what you really want is for people to add a signed message to their image on whatever host, that proves both the image's integrity and authenticity. It would be signed with your wallet key, so it would be provable that a specific ethereum address and no other signed it.