If they reject your request, find a bridge. Ask a mutual friend to show you the specific photo or screen-share the profile with you. Is this a little nosy? Maybe. But it is 100% legal and doesn't involve hacking.
To illustrate the danger, let's look at a real (anonymized) example. In 2022, a domain called "InstaLook[.]io" ranked #1 for "Instagram-private-photo-viewer." It had a beautiful UI, a progress bar, and fake testimonials from "TechCrunch."
Within three weeks of ranking, the security firm Avast flagged the domain. Here is what the investigation found:
Twelve thousand people lost their accounts because they wanted to see a private photo.
Slightly more sophisticated tools will ask you to paste a "JavaScript code" into your browser console or give them your Instagram login credentials.
The Reality: You are not viewing someone else's private photos. You are handing a hacker the keys to your account. These scripts steal your session cookies. Within minutes, your account will be used to spam others, post crypto scams, or be sold on the dark web.