It's not all-or-nothing. You can hash passwords on the client side, and hash it some more on the server side before committing the final result to permanent sto

It's not all-or-nothing. You can hash passwords on the client side, and hash it some more on the server side before committing the final result to permanent storage. A breach of your database won't give the attacker a password equivalent in that case.