This is a bit related to T15407: People: Profile Pictures should be Editable and Deletable by their Authors (not by "No one") / T15814: Files: reduce number of orphan transformed files / D25622: Transformed Pictures: make them non-orphan.

Looking at Mozilla's fork of Phabricator / Phorge, their change in
https://github.com/mozilla-conduit/phabricator/commit/8358b435a99435a95e0dffbbb92f71dc1961bc7b
clarified that transformed profile images will be public, and changed the View Policy of transformed images to inherit the View Policy of the "original" image.
Is that something to consider and backport to upstream?