It's not secure, because there are only 26 ^ 4 possible solutions. This can be brute-forced. If the picture includes capitals, we can increase this, but even 52 ^ 4 is a very small search space.
I'm assuming that it gives you a different picture at every logon attempt, but that does not effectively make the search space smaller.
However, there is one advantage to this scheme - it prevents replay. You will enter a different letter combination every time, so if an eavesdropper intercepts your input, they can't use that combination again.
Unfortunately, that assumes that the attacker gets your input but not the picture. This is an unlikely scenario, an eavesdropper (whether MITM or shoulder-surfing) is likely to get both. It does offer a little protection if all the attacker has is a keylogger on your system.
So, this is an interesting idea to prevent replay, but poorly executed.