Have they said that? They've previously removed the ability to search for users by phone number, so they recognise the problem.

I can see why someone would have unthinkingly added the profile picture to the recovery screen, but since the downside of resetting the wrong account is so low (an SMS that can be ignored by the rightful user), it seems easily fixable.