MUC avatars don't work if the occupant published their avatar in PEP only. There is little reason to intercept vcard requests to make avatars work, but not also handle PEP requests the same way.
The legacy vcard method involves carrying the hash of the avatar in presence. The PEP method has no equivalent, so this would be less efficient.
Fixed in https://hg.prosody.im/trunk/rev/11a0b32fef24