Does NGINX handle some error events / codes without them being set up in the config by default?

Nginx will handle everything except application level errors. A few examples would be

400 if the request breaks RFC specified format.
403 if nginx cannot read a file due to permission.
404 if the file isn't found.

And so on so forth, the only thing nginx doesn't handle is non-RFC requirements like your anti-hotlinking and things outside its scope such as fastcgi/uwsgi/http backends.

Basically don't worry about anything not related to your specific business logic.