The external oracle is needed not to confirm the ownership of the hash. It's needed to confirm that the original data (that is hashed) is the genuine first copy that the company or artist or anyone else created and that they did it first. As I explained before there are many tricks to create an NFT that's a copy of some earlier one but you can't verify it because it was slightly modified. For example, I want to sell you an NFT with a hash 9ebca060d1a1ef4544e33738f868c1fe1819737d50e9c43a95f3d2d4951cdda6. I show you an image that, indeed, hashes to this number. Since you assume you don't need any external oracles, you buy it and we part ways. Later you find out (from your friend) that the actual NFT you wanted to buy has a hash of 6d6e6a030355c851f7520e1a563ea3c75647a4f036ac18846fc27f2001cc7cc8 and it's one pixel different from what I sold you, it was also issued 1 block earlier. See the problem now?