Hold on a second, we're just talking about security images, not debating the whole phishing paradigm. Which would be futile, by the way, because phishing happens all the time - sometimes with homographic urls, sometimes without. As for rogue routers in the rest, you don't need that kind of thing at all. Most phishing is just getting gullible people to click on links in their inbox.

While it's true that adding security images will make the phisher's job a little harder (and yes, you will need a server but then the phisher is serving this page up somewhere already) it doesn't add that much work. And now you have a situation where you've told your users: "If you don't see the image, it's not secure. If you do see the image, you're in the clear!" You're completely undermining them. Don't you think a user is going to look at things a lot less critically if they see their pet dog or whatever staring back at them?

That's why it's worse. It creates a small amount of extra work for phishers, but once they've done that, they are in a much better position. It's like a bad gambit in chess.