The image and those settings are unrelated to what you are reporting.
What you are reporting here inherently means your reported adversary has access to millions of dollars of exploit tooling, which means you’re far beyond what assistance anyone around here can offer.
Or maybe you or somebody locally with your passcode are making changes here. (I’ve worked with (few) folks that routinely made seemingly random changes to their own settings too, then forgot they themselves made those changes, and were then upset about the changes.)
And have encountered (more) folks with compromised passcodes and with “helpful” or malicious activity then ensuing. Loaning devices to kids is just hilarious mayhem. Well, until some precious photos get permanently deleted, or worse. And these cases can get much worse than photo deletions.
If what you claim about remote hacks is the case here, this is espionage-level tooling required.
None of the above possibilities — or others — can be addressed here.
All of these cases are outside of what anybody here can assist with, and any password or passcode issues or forensics that might be warranted here requires direct local and very intrusive access, and can also involve conversations about sensitive details of your life and your particular risks.
In addition to the compromised Apple ID info from the sage reply above, some more reading, and run Safety Check here:
Personal Safety User Guide - Apple Support
