I wouldn't say don't do this, although you do have to spend your security resources carefully. While it only provides additional security against password data

I wouldn't say don't do this, although you do have to spend your security resources carefully. While it only provides additional security against password database exfiltration attacks, it is also a very, very low cost mitigation. It could equally be used in a separate authentication service as one of the many ways to harden it.