[ucaetano]

As TFA mentions, it only shows the image if logging in from a known IP or device, so the MITM won't have access to it, unless of course they can hijack your device or connection, but that's orders of magnitude harder than setting up a fake login page.