It seems that there is still the possibility to upload a profile cover picture, even though I disable "upload images" in privileges for registered users.

It's a bit off-topic but still related to default settings for external links. I haven't tested the acp of 0.7.0 yet and I was wondering if there was something like a whitelist for external links? Then if someone click on an external link we can activate the warning page "you are leaving the forum", but if it's a sub domain, a root domain or a trusted url (youtube) for example we don't show this page.