For one thing, such a scenario would typically involve the uploading of said picture or facial data or faceprint data to a third party. You have no idea how that third-party will use and/or share the information.

Some people will not have a public profile picture but they too could be subjected to it.