Turns out vcard files can store profile pictures encoded as a base64 string. It also turns out that Android doesn't import the image if you scan the data from a QR code. But it does work if you scan the code, paste it into a file, and import the file into Contacts. Yay