Question: When the user enters a valid email on the login like Google did some time ago, is there any problem to show the avatar?

Does make the experience better?

Is a there is any security risk?

Answer: 
This would be bad from the security point of view. Anyone will be able to enter any name and see if this login (if this person) is registered at this site.

Suppose you enter the name of your neighbor at some web site that sells drugs or weapon and see his picture. This would mean he is registered at this web site (unless it is a fake account). This would be a huge security problem because it discloses personal details of this person without knowing his/her password.

I'd suggest you don't display avatar until user is logged in.

To user experience:

1. If because of security reason you don't display it, then there is not much sense to discuss UX.
2. Even if you would display it, the users would think "Holy s...! They don't care about my security! What else security problems they have?"
In the case of a legitimate user signing in with their email address, this can be helpful.

There's a privacy question you should consider: if I wasn't the legitimate user owning the account, and I was just trying to snoop on someone else by entering their email address into your service, would the legitimate user be pissed off? They may not be, for example if it's already possible to look up your users' profile by email address using some kind of public search form. But if there's a chance that they will be annoyed, or if you're not sure, then sounds like a bad idea. You can somewhat guard against this case by doing it only if the user has previously signed into the same account in the same browser but this can add quite a bit of complexity.

It may also not be very valuable. In the case of Google, it helps users who share a single computer between multiple users, because it's easier to choose from a short list of accounts when their profile photo is visible than when just their email address is shown. But Google only has this problem because it has so many users that some of them end up in the same household sharing the same desktop computer, repeatedly signing in and out of the same accounts all the time. If your service doesn't have this case to handle very frequently (e.g. if most browser sessions that sign into your service only ever sign into one account) then this could be overkill.