The false premise is that the law cares about any combination of bits and/or metadata. Even talking about "provenance" is misleading, because that puts the focus on the data.

The law regulates human conduct; crimes require a human action combined with a human state of mind. Things (bits, guns, etc.) are relevant to the extent that people take actions with them. To address the RNG example: the law doesn't care about whether the bits came from an RNG or an original copy per se. The law cares about those things only to the extent that they imply that someone generated the bits randomly versus copying them from the original. (Note the focus on verbs.)

In the RNG example the distinction does not matter, but consider something like insider information about an upcoming merger. The provenance is a leak from someone inside the company. Whether it is legal or illegal depends on what you do with it (trade on it versus publish it), and what you were thinking when you did it (even if you trade on it, if you didn't know it was insider information then there is no crime).