Is it good practice to extend the identity schema to hold a link to a user's profile photo? Or is there a better way?

I would say its fine. You can also use something like the ID to link it. For example I had a setup where all that data would be in supabase and I reference the identity ID to fetch it.