I've set my profile picture only available for Friends.

However it's still visible for the public.

Non-authenticated users can see the profile thumbnail and authenticated (non-friends) can still click and see the full picture.

I've already activated option 'Limit Past Posts' in Privacy, but it didn't solve the problem.