There's a great deal of room for improvement in password protection, which would make stealing a password very difficult. Some discussion on developments in that front here: http://news.ycombinator.com/item?id=4047968
I've always thought it would be cool to have a backend environment similar to labVIEW (but faster!). I use labview in my research and it is the best solution I've found for encouraging / allowing for code re-use. This Google Blockly, to some extent, seems to be heading that way - I'm looking forward to seeing how it develops.
I think you are right - I would also imagine that you could have a collage of images with meaning to you e.g. places you've worked and you pick the order your worked at them - thus the same set of pictures could be presented in different configurations changing your tap-pattern each time.
I would be interested to see the mathematics behind their claim that a picture password is more complex than (what I assume is) a typical android log in password. I would imagine it would be a little more tricky for any malware to capture a password. Capturing and determining which mouse clicks (for the PC case) are significant is considerably more difficult that analysing the output of a keylogger.