Accessing a users data is not the only reason for hacking their account. Performing actions on behalf of a user is just as much of a threat. Edit: also, if an

Accessing a users data is not the only reason for hacking their account. Performing actions on behalf of a user is just as much of a threat. Edit: also, if an attacker dumps all the data today then loses access to the data tomorrow, having access to my password hashes means they can access my account and data later.