Don't get me wrong, I'm not trying to shut your idea down here, it just doesn't make sense with how encryption works. It's entirely all or nothing. If it doesn't have the key, nothing can be read. There couldn't just be one picture left, it would be all or nothing. If they wiped it correctly (i.e. actually using the "Erase All Content and Settings" feature), it's not possible. So there could be something else going on here. Questions I'd have:
1. Did they actually wipe the device?
2. Did they simply shut it off after they wiped it, or did they go through the first time setup and then shut it off?
3. If the latter to 2, did somebody take a test photo with the device and leave it there?
4. One would hope someone wouldn't be silly enough to do this, but given the latter answer to 2, did they then log back into iCloud for some reason? Even if you log back out, if you just immediately shut the device off, it may not have had time to delete everything that just got synced by logging in. All of this is why I just shut the device off after the wipe brings me back to the welcome screen. If you really want to be sure of something, like, say, activation lock isn't enabled, do the first time setup to make sure it doesn't prompt for your creds, and then just wipe it again.
Stuff like that could easily explain it. I highly doubt anyone is seeing pre-wipe photos on a device. If they are, 99.9999% they're simply mistaken about having actually wiped it.