Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater?

Per my understanding, if somebody is phishing your users, it's also trivial for them to proxy requests from your users to your authentic website and retrieve the security image with whatever credentials the user provides before receiving the image (e.g., the username). If this is the case, security images seem to provide no additional security, and may actually be harmful if they help convince users that a malicious website is legitimate.

Am I missing something?

Great question!  As it happens, I can present experimental data on this question -- and the data is fascinating.  (I noticed that some of the answers contain speculation from first principles about how much security these security images offer.  However, the data turns out to have some surprises for all of us!)

Experimental methodology.
"Security images" have been evaluated in a user study, conducted with ordinary users who were asked to perform online banking in the lab.  Unbeknownst to them, some of them were 'attacked' in a controlled way, to see whether they would behave securely or not and whether the security images helped or not.

The researchers evaluated two attacks:


MITM attack: The researchers simulated a man-in-the-middle attack that strips off SSL.  The only visible indication of the attack is that lack of a HTTPS indicator (no HTTPS in the address bar, no lock icon, etc.).
Security image attack: The researchers simulated a phishing attack.  In this attack, it looks like the users are interacting with the real bank site, except that the security image is missing.  In its place, the attack places the following text:


  SiteKey Maintanance Notice:
  Bank of America is currently upgrading our award winning SiteKey feature. Please contact customer service if your SiteKey does not reappear within the next 24 hours.


I find this a brilliant attack.  Rather than trying to figure out what security image to show to the user, don't show any security image at all, and just try to persuade the user that it's OK that there is no security image.  Don't try to defeat the security system where it is strongest; just bypass the entire thing by undermining its foundation.


Anyway, the researchers then proceeded to observe how users behaved when they were attacked in these ways (without their knowledge).

Experimental results.
The results?  The attacks were incredibly successful.


Not a single user avoided the MITM attack; every single one who was exposed to the MITM attack fell for it.  (No one noticed that they were under attack.)
97% of those exposed to the security image attack fell for it.  Only 3% (2 out of 60 participants) behaved securely and refused to log in when hit with this attack.


Conclusions.
Let me attempt to draw some lessons from this experiment.


First, security images are ineffective.  They are readily defeated by very simple attack techniques.
Second, when assessing what security mechanisms will be effective, our intuitions are not reliable.  Even expert security professionals can draw the wrong conclusions.  For instance, look at this thread, where some folks have taken the view that security images add some security because they force the attacker to work harder and implement a MITM attack.  From this experiment, we can see that this argument does not hold water.  Indeed, a very simple attack (clone the website and replace the security image with a notice saying the security image feature is currently down for maintenance) is extremely successful in practice.

So, when the security of a system depends upon how users will behave, it is important to conduct rigorous experiments to evaluate how ordinary users will actually behave in real life.  Our intuitions and "from-first-principles" analyses are not a substitute for data. 
Third, ordinary users don't behave in the way security folks sometimes wish they would.  Sometimes we talk about a protocol as "the user will do such-and-such, then the server will do thus-and-such, and if the user detects any deviation, the user will know he is under attack".  But that's not how users think.  Users don't have the suspicious mindset that security folks have, and security is not at the forefront of their mind.  If something isn't quite right, a security expert might suspect she is under attack -- but that's usually not the first reaction of an ordinary user.  Ordinary users are so used to the fact that web sites are flaky that their first reaction, upon seeing something odd or unusual, is often to shrug it off and assume that the Internet (or the web site) isn't quite working right at the moment.  So, if your security mechanism relies upon users to become suspicious if certain cues are absent, it's probably on shaky grounds.
Fourth, it's not realistic to expect users to notice the absence of a security indicator, like a SSL lock icon.  I'm sure we've all played "Simon Says" as a kid.  The fun of the game is entirely that -- even when you know to look out for it -- it is easy to overlook the absence of the "Simon Says" cue.  Now think about a SSL icon.  Looking for the SSL icon is not the user's primary task, when performing online banking; instead, users typically just want to pay their bills and get the chore done so they can move on to something more useful.  How much easier it is to fail to notice its absence, in those circumstances!


By the way, you might wonder how the banking industry has responded to these findings.  After all, they emphasize their security images feature (under various marketing names) to users; so how have they reacted to the discovery that the security image feature is all but useless in practice?  Answer: they haven't.  They still use security images.  And if you ask them about their response, a typical response has been something of the form "well, our users really like and appreciate the security images".  This tells you something: it tells you that the security images are largely a form of security theater.  They exist to make users feel good about the process, more than to actually protect against serious attacks.

References. For more details of the experiment I summarized above, read the following research paper:


The Emperor's New Security Indicators.  Stuart E. Schechter, Rachna Dhamija, Andy Ozment, and Ian Fischer.  IEEE Security & Privacy 2007.  (edit: updated link)

