Many have restrictions that new clients can tend to ignore, thinking they are special and can be that exception. Or, she may have a stalker / ex that she fears. Or, she may be new, and is scared that an unknown man will be in her home while she is naked and vulnerable, and wants to have a picture in the cloud of who killed her to help the police.
And if you think a picture on her phone is a security risk, you certainly have no idea about hidden cameras and security cameras, You will be caught on tape entering the building no doubts, and you could be being filmed from a dozen angles in the session without you knowing. Far more an issue than a face pic on the phone.
Or maybe she wants to make sure its you at her buzzer when you show up for the appointment. I have heard of many SP's (and actually encountered it more than once) that get buzzed, assume it is the client that has booked, lets them in only to find out that it was someone thinking they could show up without an appointment, only to have the actual booked client show up 10 minutes into her session with the walk in.
Or, maybe this is a real easy way of deciding whether you are or are not a serious potential client. Many SP's have screening methods, photo first is not the most stringent of them.
Its your call. If you don't feel safe, you have the option of moving onto the next SP. To me, its much less a red flag than an endorsement of her seriousness about security. Unless her ad gives off serious red flags for concern that she might be being trafficked or in some other way controlled/abused.