Passed on to the regular Steam team.
I'm sad to see that the problem was only partially resolved, but I was already expecting something like this from steam, tell me is that difficult to assemble a competent department for privacy and security?? Your security and privacy failures are a joke..
If you click on the image to get a bigger size you will get a static akamai link that circumvents the privacy options and can be opened worldwide without restrictions: http://images.akamai.steamusercontent.com/ugc/*LINK*
You can open a Steam support ticket if you want to pursue this further.
Nothing extracted yet.
Please describe your issue in as much detail as possible:
Steam artwork set to friends only is visible to anyone on the web that gets the link or bruteforces it.