Google's John Mueller said that if someone takes your image and embeds it on their site using your image URL as the source, also known as hotlinking images, that image would not be considered a link to your web site.
So if you take an image from my site, but don't just copy it to your server, instead you request the image from your server, that won't be considered an inbound link.
So there is no need to nofollow those links but there is also no reason to be excited that the person is stealing your images and wasting your bandwidth along with it.
Here are John's tweets on this:
Just to be really clear, there's no need to disavow if a site embeds images from your site. We don't see those as links to a site. (Sometimes people embed images AND link to your site, in that case, links are links, do whether or not you disavow ... it depends)
— 🍌 John 🍌 (@JohnMu) September 26, 2019
I suspect my reply there was a bit confusing since you wouldn't have a paid relationship there / unnatural "embedding" anyway, so no need to do anything.
— 🍌 John 🍌 (@JohnMu) September 26, 2019
Forum discussion at Twitter.