Yes, that's true too. It's a common Windows malware distribution vector - bad actors send files with names like "photo.jpg.exe" or even "photo.exe", with the icon resource in executable's metadata set to look like default image icon, or even a thumbnail of some real photo.