It's good because instead of tracking your keystrokes, spyware will have to take screen shots of your web browser whenever it notices a login form in the web browser.
What it might do is solve a lot of security issues as a side effect-- by forcing users to stop using their single password on every web site, which is what many or most users do right now. Although, now they'll just use the same three image categories, unless they really want to memorize many sets of them for different sites, and competing visual authentication systems.
What it really does is allow companies to pay money for showing pictures. This isn't to help consumers, since this forces users to take the additional step of thinking every time they login. It's to make deals with ad agencies.
