All photos set to public on your Facebook profile can be used by anybody and become their profile or cover image. Profile and cover image for some time are already set to public at the moment you put it as cover or profile.
If your photos are set to friends at the moment your friend use it as profile or cover image it becomes public.
Even photos put on your friends timeline by not your friends, but it is visible to you because of setting: seeing by friends of your friend, you can use and put as your profile and cover image. At the moment you put it as cover it is set to public.
This is very bad move from Facebook. What can you do? What will I do? At this moment first step just to protect me I will lock all photos uploaded to Facebook, from PC or mobile. Second, I will immediately stop uploading photos from PC and mobile to Facebook. If nothing change (waiting for respond from Facebook) all that photos will be deleted from Facebook.
You will need to protect your privacy by yourself and be careful!
Have a great day!
Facebook profile image - not friends with
photos set to public - not friend with
photo from my friend timeline shared with person I am not friend with - look at the setting of that photo. If I put that photo as my cover it will become public.
this is how my timeline looks like - profile and cover image are set to public