Attacks like these can be easily dwarfed by employing a nonstandard virtual keyboard which displays a randomly permutated key layout during PIN entry. Some online banking web apps did this already ten years ago as a defense against "mouseloggers". Using a good RNG is advised though.