The point of this method, I believe, is not that it has come up with a more secure password -- which it most definitely has not -- but rather that it has come up with a password that the user cannot reveal to anyone. Any password, even those that are 20 characters long and full of gibberesh, can be written down or told to someone else, compromising the password.

But if you are trained to recognize specific images, it's much harder to tell someone or write down exactly what the images look like. While you can tell someone that you saw a picture of a duck, when someone who is attacking your account is shown 10 pictures of ducks, they won't know exactly which one you saw.

So, you probably wouldn't want to use it as the only authentication method for your account, but in combination with a traditional password, it can provide an different type of security that is harder to compromise.