Right to be forgotten
Facebook makes any photos uploaded to it available indefinitely, and they were notified of this bug/'feature' years ago. Will this make any difference?
All that is needed is the URL of the image. Even if the person has their profile locked down in every way. Even if the user has 'deleted' the image from their facetard. Even if the nonce/spook/terrorist/employer doesn't have an account.
So much for setting permissions to "Friends only".