When a user sets their profile picture to "Private" (or sets their entire profile to private), Facebook does not simply hide the image. Instead, they change the access control list (ACL) attached to that image file.
If a user has ever set a particular image as their profile picture while it was public, it might have been indexed by Google. You can try a reverse image search. If you have a small version of the profile picture saved, you can upload it to Google Images. Alternatively, you can use a specialized search like site:facebook.com "[Name of Person]" to see which images from their public timeline appear in search results. facebook private profile picture viewer online
The short answer is simple: