how a ordinal data is not saved to a UTXO
Again, wrong. The protocol used to track inscribed ordinals follows transfer of the ordinal through UTXOs.
For example:
https://ordinals.com/inscription/78d6a47167a10429450d1e36e091be721c40eed14c7250c8faa6e66713f6966fi0
The address to which the Ordinal NFT was minted is:
bc1p0qc0qjselqjj2mue82nl4c89z8ll8nvn7wn6g4uczfk0qsgf5r3sj3dy3m
That address sent it to this address:
15swCYzNK2FrE9MWN1zHTT8Fhwn5nwZV75
You can see the tx used the minting transaction ID as its sole input:
This is all the information that is required to track Ordinal NFT ownership. So long as inputs are not mixed or spent in other types of transactions, the history of ownership is quite clear and it is all based on UTXOs.
By themselves they are harmless, BUT to be taken advantage by a bad actor, it could open another attack vector that could used for nefarious purposes. Perhaps to constantly make the network congested through dick pic transactions? There's probably high demand for censorhip-resistant dick pics.
It has always been a matter of whoever is willing to pay the fee is entitled to the blockspace.