The server restricts the profile picture to a small thumbnail.
Even if an app doesn't steal your password, it may request broad permissions to access your phone's contacts, storage, personal location, and browsing history to sell to third-party advertisers. Do Legitimate Workarounds Exist?