Yes, and those people didn't get their profile pictures exposed through this phone number enumeration. If they had, then maybe it would have qualified as a security breach.
They did and this was not enumeration, did you read post?
And yes the pictures were leaked in the process.