Similarly, publication of an image on the internet is not implicit permission to use it for any possible purpose, however technically feasible. For example, deepfakes.
If I download, copy, or edit images sent to my computer, the original is still there.
The artist puts their art on the gallery with the intent that people will enter that gallery and look at it without touching. The image uploaders uploads the image with the intent that a copy (not the original) gets sent to our computers when we look at Google Reviews.
- Drawing a mustache on the art = Vandalizing the original data (not what's happening).
- Taking the art home = Deleting the original data (also not what's happening).
- Scraping faces for an AI = Following visitors around the gallery, taking secret photos of them, and publishing a book that rates them by attractiveness.
The fact that the gallery is "public" does not make that behavior acceptable. The same is true here. "Publicly viewable" does not mean "publicly available for any use."
The visitors took the photo, supplied the photo, and put it in a public place.