Yes, cover picture/photo is what I mean I think. The two images you can put on top of your profile page. One is the small round icon and the other one is like your header on FB for example. Both seem to be called cover picture.
First, I realized immediately after posting that using a plugin IS the way to not break updating and depending on the updates, the plugin would have to be updated too.
Second, yes, poorly configured security could allow someone to clickjack but using X-frame and other headers is typically used to mitigate those kinds of problems.
I'm not sure what you're suggesting however. Are you saying it would be a bad idea to use an iframe in the way I'd like to or that it can be done, just have to be careful to use good security?
My interest is basically to try making our forums a more usable and interactive environment than simply support questions being answered. I'd love to use nodebb if possible.