I think your plan of action for updating the photo is the best course of action.

One reason for the live_profile being a "duplicate" is that some users (like us) use Connect Support chat. The Connect Support chat session relies on the information within the live_profile table and allows us to give our users a "public facing" profile with a custom name (so their last name is not shown) and a company logo for their avatar (so their personal picture is not shown).

Your business rule sounds like a perfect way to achieve this if you always want them sync'ed. I would just question whether you do need to sync them or not. At least in Connect Support if I leave their photo blank in live_profile it uses the one from the sys_user table.