There's a permission under avatar_selection_module called "upload avatar in profile". It doesn't seem to have any effect.
The ability to upload a user "picture" is controlled in core on the User Settings page, regardless of whether the avatar_selection module is enabled. It would make a sense to be able to restrict user picture upload by role, but that feature doesn't exist in core.
Is this a proposed feature that never got implemented but the permissions still appears?