They only show the picture after you have logged in successfully from the device. If it is a new device (or attacker), the picture is blank and the site says so

They only show the picture after you have logged in successfully from the device. If it is a new device (or attacker), the picture is blank and the site says something like “first time using this device?” So it helps against phishing or a MITM that doesn’t intercept the real site cookies.