Databases leak: backups get copied and servers get breached. If passwords are stored the right way, a leak gives attackers almost nothing. Stored the wrong way, it hands them the keys to every other site where people reused the same password.