They can, but it is VERY unlikely.
Since both Youtube videos and images go tru multiple stages of cutting, converting to other formats etc. it's very unlikely that your exploit would be kept in such environment. Best it could do is hijack one of Google's converters where it would probably easily raise some red flags on intrusion detection systems.
Even assuming your exploit would be able to survive such changes (which is basically impossible), then it would be subjected to many different OSes, web-browsers etc. It is very likely that many of configurations would detect something bad with your image, so most systems wouldn't play this video/wouldn't display this image, possibly even detect that exploit (because antiviruses, incompatible OS, EMET etc.). This again would raise some red flags, most likely before that video was seen by many people. And your impossible exploit would be ruined.
And that's exactly why most exploits are kept for valuable targets - it's very easy for them to be found in so diverse environment that Internet certainly is. And then they quickly become useless, because most of users who were vulnerable quickly update.