However, if accessing the photo required authorization, then this would be a non-issue, since non-authorized users would not be able to access the photo in this

However, if accessing the photo required authorization, then this would be a non-issue, since non-authorized users would not be able to access the photo in this way. That still wouldn't affect the fact that your authorized users could copy or screenshot the photo, but it would mean that the company itself wasn't serving photos publicly when the users specifically instructed the company not to do so.