I am totally comfortable gating this feature by trust level, so site admins can select what trust level users are allowed to upload profile images or user card images.
min_trust_level_to_allow_profile_background: default 1
min_trust_level_to_allow_user_card_background: default 1
pr-welcome on that