It is quite a bit easier than you make it sound. The photo will have been posted with a audience selected - something like "Only Me", "Friends", "Public". If people were tagged in the photo and it is set to "Friends", then those tagged and their friends can see it (the audience selector will put a little "(+)" there to let you know it has expanded it to friends of those tagged).
You can also use a custom audience selector to do things like specify a friends list (or more) to share with, not to share with friends of those tagged, and so forth.
Here is a link to the help page on privacy basics that starts with setting/modifying audience for posts: https://www.facebook.com/help/325807937506242/
If somebody likes that photo, that like will only be visible to those that can already see that photo. It does not give anybody the ability to see the photo that did not already.
In many cases, you can see the audience selected for posts your friends make by looking for the same icons from the audience selector next to the date and other metadata in your news feed, their timeline, or the picture page. If it is public, there'll be a little globe. If friends, then it'll be two people standing next to each other. If friends-of-friends, three people standing there. Obviously, you can't tell if it was shared with only them (since you wouldn't see it). In some cases (the person chose a custom audience), a gear icon will appear.
If after you investigate based on the information above you really think the privacy model expanded who could see the photo because of the like, please report a privacy bug: https://www.facebook.com/help/contact/?id=308229232560802
(In case it wasn't obvious, I work at Facebook. But I don't work on privacy specifically.)