Ok I found the solution to my problem...
First of all,
core_files_get_files is not the way... it will only show files information, it won't give you the actual file contents (binary).
Fortunately, there's an equivalent URL to be used when calling from external client app:
It accepts the same parameters/format as http://my_moodle_server/pluginfile.php and in addition you can also pass your token for web service authentication.
profileimageurl field returned by
core_user_get_users_by_field which looks like this:
can be turned into
Also note that appending
?token= parameter is required