The way I read the article, the “worth millions” is the sum of the ransom demand.
The funny part is that the exploit is in the “smart” contract, ya know the thing that the blockchain keeps secure by forbidding any updates or patches.
Well, digital trading card games do exist of course, but often you can’t even trade cards. And much less sell them for real money. With an NFT in theory you could do what you want with the card, like give it to your buddy for 10 bucks and you don’t even have to use the game client for it.
The problem here is that the card itself is in the game code, so you can freely move ownership, but the game could just remove the card and make your NFT worthless.