Amodule-based solution is preferable. Is there a better way of doing this,
ie without a new content type? Essentially I'm looking for a user-friendly
way for users to upload and show their profile pictures.
I would like to recommend field_collection module as I already mentioned in the question's comments.
Step # 1: Enable field_collection module.
Step # 2: go to /admin/config/people/accounts/fields
and add a new field named as User Gallery (machine name should be field_user_gallery) and choose field type as "Field collection" and save. Note that you can set the field cardinality as you like.
Step # 2: Go to admin/structure/field-collections
and add a new image field named as Image (machine name should be field_image) and choose field type as "Image" and save. (It might already be added in the existing field list.)
Step # 3: Download custom module from custom_user_profile and extract to your module directory. Make sure extracted directory name is custom_user_profile and then enable it.
That's all. I hope it will work for you as works for me.
/admin/config/people/accounts/fields
(you can also set its cordiality). While adding field collection field in/admin/config/people/accounts/fields
you will see the new permissions block and you can control who can add/view/update this field collection.