Paranoia of authentication systems is considered the default and healthy state, here.
While you're correct that shoulder surfing is the threat model that the site is trying to mitigate, unless your cubicle-mate and evil maids already have a good idea of your password and just want to verify it, they're unlikely to know the jdenticon pattern. Someone who you share passwords with may be able to recognize an insecure password, of course, if they also use that system, so don't share passwords.
Still, some can argue that the jdenticon should be hidden by default, and only visible with explicit user interaction if you need to verify that the secret was entered correctly, just as the eye-with-a-slash icon also shows the plaintext of your secret. If you think that shoulder surfing may be an issue, you can pre-emptively hide the jdenticon using CSS override extensions in your browser.
This is a somewhat moot point, though, as services like Getpass encourage low entropy passwords and password reuse, despite their best intentions.
With a deterministic password generator and several known (no entropy) values as its input, such as your username and the site's name, the only entropy left comes from your Getpass secret keyword. While most people won't be targets of spear phishing attacks, if you are, and attackers determine that you're using a deterministic password generator, then they can brute force that secret keyword. They won't need physical access to any of your devices, and won't trigger emails notifying you that a new/unknown device logged into your password manager.
Instead, use a password manager that generates a password from high entropy sources, and that either requires physical access, or notifies you of unexpected access.
Deterministic password managers do not add security, they only add obscurity.