Would you be able to clone someone debit card if you only have the picture of the card with the security code and the PIN?
No. The security code on the back of the card is the CVC2 code, which is only used for "card not present" transactions. It differs from the CVC1 code, embedded in the magnetic stripe (if your card has one).
If you can obtain a copy of the information on a mag stripe, it is relatively easy to put that same information on a new card's mag stripe to clone the card. But most cards these days also have a "chip" (which might even fully replace the mag stripe) which sends yet another code, the iCVV, as part of a transaction. The iCVV differs from both the CVC1 and CVC2 codes, and may in fact even differ from one transaction to another. Chip cards use the EMV standard to further protect the transaction data using cryptography, making it quite difficult to clone the card for use in future chip transactions even if you have the required equipment to manufacture such cards. However, many places still have mag stripe readers to allow using cards using only the outdated mag stripe technology, so not being able to copy the chip does not necessarily prevent use of the card.
A visual image of the card gives you enough information to use it for online transactions through a web page, over the phone, or through the mail, where you manually give out card information. It does not allow cloning the card for use in a store.