If they have a list of usernames (easy enough to get, or guess), they just have to do an automated series of bulk requests
You're both overthinking it... How would your web browser normally get the picture from Google during a legit login? Something like submit your username to a page and get a picture back? The bad guys would use exactly the same process just with the malicious server as a MITM.
Good point - this would be a very simple way to circumvent it.