There is a way to show profile pictures to only contacts. It's a setting.

Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. If they had, then maybe it would have qualified as a security breach.