You get a preview of the photo when the request comes in. But they must have had everyone set as possible senders. I don’t think that is the default setting.
The only reason I can think one might flip that on is that say you meet someone and they want to send you a photo. But you don’t want to formally add them to your contacts, so you flip this setting to everyone “temporarily”. You then forget to turn it back off.