Yes, if an attacker compromises the database they can send the direct hash. The point is that a malicious or badly-secured site can't use your password on othe

Yes, if an attacker compromises the database they can send the direct hash. The point is that a malicious or badly-secured site can't use your password on other websites, because ultimately most people use the same password on many different sites.