Lots of badguys steal pics and use them for bogus ads too.
Defaulting profiles to private makes sense as anyone can turn them on for all to see. But I would say Ray makes a good point; if you are going to point them to your profile it should be accessible.
Also, a lot of people have pics of their family, I am not sure I would want somebody grabbing a pic of my wife or child.
Its a pain but I would say the reasonable way to go.
Scorp