If this is the case, security images seem to provide no additional security,
Instead of pulling a static copy of the login page, now the phishers have to make a page capable of interacting with the original website.
An extreme hypothesis is that they are extremely dumb, and will retrieve the custom images with their own IP, or an IP that can be linked to them.
A less extreme dumbness hypothesis is that they will retrieve many custom images with one or a few different IP addresses, which might raise suspicion for IP addresses from ISP not known to use carrier wide NAT.
But the same "origin IP" issues exist with a phishing of the simple type, with the ordinary login/password pair: the only value of these collected data is that they can be used to log in the original website. The phishers always need a pool of "good looking" IP addresses if they don't want to raise suspicion (what a "good looking" address is depends on the webpage and its audience).
For bank phishing, the money must be transfered by "mules" to intermediate accounts. The fishers need not only IP addresses (a botnet can provide these), but also intermediate bank accounts. Real people must provide these accounts.
Phishing at a large scale certainly requires good planning, and strict security procedures, because sooner or later, the fishing operation is going to be discovered, and investigated. And when it is, the people in charge of the phishing operation certainly care about their privacy (not being found).
I don't know the exact details of such operations, but I don't believe the addition of "download the security image" is going to be a deterrent.
and may actually be harmful if they help convince users that a malicious website is legitimate.
The average likely to be victim of phishing user is unable to do the proper security evaluation of the scheme. Almost all such users will overestimate the security benefits.
And do users even check the security image?