I can confirm this bug.

I see no reference to ALLOW_REMOTE_AVATARS in changebasic.inc.php and no proper checks in newuser.inc.php. The only references I can find where the value ALLOW_REMOTE_AVATARS is checked is to determine whether or not to display the HTML.