Bookmarked:
Marcus Povey describes why a website should not show webmentions with embedded images from the source site (as it could allow the publisher of the source site to track the audience of the cited site).
This is not Webmention or Indieweb specific, but a general privacy risk: whenever loading resources from a third party, that might enable them to track a user.
(Not mentioned in the post, but the suggested solution of caching the images of course opens yet another can of worms: strictly speaking that might be a copyright infringement, unless the owner of the profile image has consented to it being copied.)