FWIW it doesn't seem that's what happened in this case. It seems the NFT was just part of the attacker's ruse, where they told a story about some NFT staking da

FWIW it doesn't seem that's what happened in this case. It seems the NFT was just part of the attacker's ruse, where they told a story about some NFT staking dapp they launched. Then the malicious dapp asked for permission to transfer the victim's aWETH tokens. This is just part of the ERC-20 API, unrelated to NFTs. While it's true that NFTs can be sent without permission and can contain code, users normally invoke contracts via (hopefully trusted) dapp websites, such as app.uniswap.org. Invoking code from an NFT I found in my wallet is possible, but not part of any normal/legitimate workflow that I'm aware of.