This is to a large extent just security theater. It forces users to hop through a couple of hoops in the name of security, and thereby make them feel secure since they expended effort in the name of security.
That said, it does in fact defeat a simple key logger (since no keys are pressed) or a mouse click logger (since knowing the coordinates of a mouse click will not give you any information about what number was clicked).
However it does not protect against more sofisticated attacks. If someone has managed to install a keylogger on your computer, it is effectively game over. It is not longer your computer. If someone can install a keylogger, they can also install a program that hooks into your browser and logs everything being entered into a text or password field, or all outgoing HTTP and HTTPS requests before they are encrypted with TLS. Just like a keylogger, malware like this does not need to be targeted against a specific site to work.
In addition, they come with a number of security downsides (apart from the usability):
- They are more vulnerable to "shoulder surfing", as the screen is harder to hide than the keyboard.
- Since only numbers are allowed in this case, it limits the number of possible passwords and therefore makes brute force attacks easier. There are about 2000 million different passwords with six alphanumeric characters. There are 10 million different passwords with six numberic characters.
One upside, as techraf mention in comments, is that you avoid revealing smudge marks on touch devices.