The client's hash is the password but the password file contains salted hashes of the client's hash. An attacker that has the client's password hash can replay

The client's hash is the password but the password file contains salted hashes of the client's hash. An attacker that has the client's password hash can replay it, but they don't know the user's password. An attacker with the password file doesn't know any clients' password hashes or whether any of the password hashes are reused by different users.