I had a similar problem where unapproved members could still log on and see thumbs and the photos cover. Maybe their profile photo was also posted to the timeline, but I didn't check.
The photo will get posted to the Photos module because that's where it's stored. You may be able to see it there but can others? That's why it's essential to set up a test profile for you to see what others see. The same goes with the timeline. You see everything, but members only see the timeline of their friends if I recall. As the unapproved member is a friend of no one, nobody should be able to see the photo except you as admin (maybe).
In any case, I fixed my problem and made the site far more secure by using a small free mod supplied by AntonLV. Here's the discussion and the link to the mod:
https://www.boonex.com/forums/topic/Unapproved-member-can-see-Photo-and-Video-home.htm
Hope this helps.