JWTs are inherently about stateless authentication. This means you can verify it's valid by checking a public key, authenticating the token is issued by the party the token claims it is.
In terms of stealing the JWT - yes, you can take this key and it will be valid everywhere. But the message contained in the JWT can change. This is where authorisation scopes come in - you can specify this token is only valid for this specific purpose. Stolen JWT can be kinda useless if the resource being accessed require more scopes.
You can also expire tokens. If stolen it will only be valid for a short time, limiting the damage.
Also, storing it on a user end point is fairly secure given cookies are only accessible by the site and not by some other site.
Google's Firebase is used exactly in the flow you describe. A third party is the auth provider, issuing a JWT. You check Google's public key to verify the JWT is indeed signed by Google and can use that as proof a user is authenticated for the scopes the token says they are.