Yes, it is named as ‘logo’ within the response of the legacy endpoint which would be the ‘profile image’ in this case.
Chaining would be fine to get the additional info required but also doubles the amount of requests made, which could be avoided if some info was included in the first endpoint called. In my particular case, the ‘notifications’ info would still be missing.
This new endpoint combines from what I can see 2 legacy endpoints (get-channel-followers & get-user-follows) and can switch between the two based on either ‘from_id’ or ‘to_id’. The original ‘get-user-follows’ contained information whether notifications are activated or not. This is missing for me now altogether. I cant seem to find out what users I follow that I have the notifications active for per API
The restriction can be lifted by comparing the token owner with the to_id and then showing if the notifications are active or not. This way not everyone can see who receives notifications from whom but rather only I can see my own. Currently (as you pointed out) this is not the case.
I will add this to the uservoice