It depends on the user's privacy settings. You can set who can see the profile photo: everyone, your contacts or no one.

But I don't know what is the default setting.