I have learned the hard way that these are just easy-to-guess extra passwords that let attackers bypass my hard-to-guess password. I dump them in my password manager so I don't get locked out, but I know they're a ticking security time bomb. Every site asks the same questions, so if the database gets compromised, it lets someone compromise other accounts. And, they're probably not even one-way-hashed, because customer service people ask for them on the phone and can probably see the answers. I don't even know how it's legal to use these things anymore. They set the field of information security back two decades.
(I have always assumed that they exist to save money on call centers. You get locked out, you have to talk to a real person, and real people want salary and benefits. But with the abysmal success rate that the paper shows, I'm not even sure it's saving people money. It just seems wrong on every level. For that reason, I know they're here to stay for good.)