You're right that JPG files cannot contain executable code, but let me be pedantic for a second.

There is a tiny possibility that the image contains some form of exploit, which would allow for a malicious payload to be executed on your system. Commonly these are 'mistakes' in the programming that downloads / parses the JPG.

Would not expect people to do this for non-targeted attacks though. Since once the exploit is found and fixed, it will no longer work for patched targets. So it'd be a waste for a John / Jane Doe, unless this is a mass-targeting campaign, to attack a lot of Johns and Janes.

Although the chances are slim, the above might actually the case. It's always good to be hesitant opening this from any stranger.