No, Apple does not require that iBeacon UUIDs be baked into an app.
A better practice for more robust apps is to fetch these UUIDs remotely from a web service that fronts a database like you suggest.
My company has developed a web service called ProximityKit that does exactly that. In addition to getting a list of configured iBeacon identifiers from the web service, you can attach key/value pairs to each configured iBeacon so these data are available to your app. In your example, these key/value pairs could be image URLs, which you then download to your app after launch. ProximityKit comes with both iOS and Android client libraries so it is easy to integrate with your apps.
As you suggest, this general approach allows you to make configuration changes to your app after it is approved in the store. This is a common best practice for mobile apps that is not specific to iBeacons.