NFTs are tied to the owners Ethereum address - however they do not actually 'live' on the address. The NFT contract just stores data that says "token #50 is owned by this address".
ERC-721 tokens use an approve
function. This let's you grant permission to another address/contract to transfer tokens that you own. NFT platforms use this, allowing things like gas-free listings and auction bidding. Yes, there is an inherent risk in allowing this permission to stay enabled.
A 'vault' wallet would just be an ethereum address that has not set approvals for any tokens to be transfered by anyone else. This could be a hardware wallet or paper wallet generated offline to keep the private keys from ever being exposed.