Appropriateness is nothing compared to guarding against all the exploits and vulnerabilities in media files these days. I figured that was the primary reason for no custom avatars.
Perhaps a compromise could be that a user could upload an avatar if they have been registered for some predetermine amount of time coupled with a minimum of some predetermined number of posts: sort of a way to ensure that the person is a valid member of the community and likely trustworthy enough not to post a porn or exploit avatar. Plus, that way it would drastically cut down the number of avatars to be checked to a feasible amount. (Would be even easier if there were some kind of scanner that can check a pic for vulnerabilities.)