There is nothing wrong with this on its own. The real flaw was not stripping the exif data. Although I guess sequential IDs did enable an easier attack on the real flaw.