[SalesForce] How to i get Thumbnail Image depending on files of chatter

BritishBoy above is correct -- so the only way I could find to access the User Photos is through the URL:

Id fromUserId = '005o0000001drai';
Id toUserId = '005o0000000ygsZ';

for (ConnectApi.BatchResult eachResult :
     ConnectApi.ChatterUsers.getUserBatch(
         null, new List<Id> { fromUserId })) {
             ConnectApi.User eachUser = (ConnectApi.User)eachResult.getResult();
             ConnectApi.Photo p = ConnectApi.ChatterUsers.getPhoto(null, fromUserId);
             Http h = new Http();
             HttpRequest req = new HttpRequest();
             req.setEndPoint(p.fullEmailPhotoUrl);
             req.setMethod('GET');
             HttpResponse res = new Http().send(req);
             Blob b = res.getBodyAsBlob();
             ConnectApi.ChatterUsers.setPhoto(null, toUserId, 
                 new ConnectApi.BinaryInput(b, res.getHeader('Content-Type'),'user3.jpg'));
         }

Note that there's a couple caveats with the method above:

1. You need to authorize your Salesforce instance as a "Remote Site"
2. I was only able to get this to work with the fullEmailPhotoUrl property, as it doesn't need authentication

Well, I had sort of answered my own question, but haven't found any documentation to support this.

The PDF rendering indeed happens as its own call with its own context. In regular Salesforce, this continues to execute as the user who made the initial controller call. In the community, this doesn't happen as the authenticated user, but rather the unauthenticated Community Guest User. The URL in question for the image is protected, and requires an authenticated user to access it. The underlying data is also protected, hence no values populating the PDF. This is borne out both in the Debug Logs, and that I was also able to render an image from an unprotected URL (e.g. https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png).

It seems, therefore, the options are:

• Follow other, similar answers and host these images in Static Resources (which, pushing them up would require the Metadata API, and hanging on to the reference for it). Pass the rest of the data into the page as well (likely unacceptable for sensitive data).
• Push the images up to be hosted elsewhere, where they would be unprotected resources, and again, hang on to the reference.
• Pass the base64 encoded image to the page, have the page pass it to an unprotected webservice in a regular GET request, and receive the image back. Confirmed to work, ugly as it is.
• Get Salesforce or the underlying Flying Saucer library fixed so that PDFs can render base64 encoded images, and use the base64 encoding in the VF page rather than a URL.
• Use a different PDF rendering engine entirely.
• Access the VF Page with an HTTPRequest, rather than PageReference.getContent(). In this manner, you can manipulate Request fields like headers, and you can set authentication in the request. The VF Page will then run as the user of the provided authentication.

I would have liked to have seen some documentation in Salesforce stating the difference in behavior between regular use and Community, but so far I haven't had any luck.