The url of userpicture is
http://example.com/pluginfile.php/<userid>/user/icon/<theme>/f1
to example: https://moodle.org/pluginfile.php/413184/user/icon/moodleorgcleaned_moodleorg/f1

Have privacy problem because of everyone can view user picture include guest.
I blocked user:viewdetails for guest but he still can view the user pictures of all the users.