Each member can also set the privacy level for their profile. If you don't want members changing who can view their profiles, then you need to remove that block from the profile edit page.
You can run a query on the database to set all current members to "Friends Only" for their profile page view. You can also set it so that all new members that join will have their profile page only viewable by friends.
However, that would not show the profile photo.
Another thing is the individual blocks on the profile page has a privacy setting. To do what you want, you need to leave the profile page view setting as is, and then you need to set the view for each individual block to "friends only" leaving the profile photo block as viewable by members (or even public). If you don't want the users being able to change the privacy settings of the blocks on the profile page, then you need to remove the yellow keys from the headers; you can do this by using CSS or changing the yellow key font; hiding the yellow keys has been mention in a previous forum topic.