When enabling the new newsletter template, which is available since CR4, the profile pictures are not shown on the received newsletters. After setting the profiles app security role "Readers" from "All Authenticated in Application's Realm” to "Everyone", the profile pictures are shown.
However, anonymous user are then able to search for any profiles via "Display full search options”. This is definitely not an acceptable behavior, specifically if you have external Connections user.
Implement a mechanism which allows displaying the profile pictures on newsletters without weakening the app security for profiles.