this is most likely the case, pict-rs headers allow caching basically forever and don't include revalidation. i'll bring this up with the pict-rs dev about changing the default or adding a config option for this.

something like s-maxage should do the job, though it'd probably be up to the instance operator to decide on a sane value for that, as it will always be a tradeoff.

ideally, lemmy would have a mechanism for cache purging, but i suspect that this might be something that people will have to implement themselves using the 1.0 plugin system at some point, as it's probably not going to become core functionality to support e.g. cloudflare cache purging.

edit: it seems that the 1 year cache is already an override by aussie.zone - pict-rs only sets a 7 day max-age, which is passed on by lemmy as can be seen e.g. on lemmy.ml, which isn't behind cloudflare, or on progamming.dev, which is behind cloudflare but doesn't seem to be overriding it.