To answer the question: The website admin must be in on the exploit.
That is to say, if I had encoded an exploit into
pleasedontrunthis.jpg, I (the web admin), would still need to open the image like so:
To answer the question in the title: Not really.
In practice this means that someone could hack a website (ie, through a Wordpress vulnerability), and deliver a silent exploit that would take longer to find.
In reality, if an exploit in the toolkit was capable of pwning your machine, it would have most likely pwned your machine either way. The reality being that not all malicious code is going to make itself glaringly obvious, so there's always an inherent risk when deciding to allow it.