EDIT: responded to the wrong comment, apologies. I really don't understand your point. If I hash on the browser the hash is still being sent to the server. A M

EDIT: responded to the wrong comment, apologies. I really don't understand your point. If I hash on the browser the hash is still being sent to the server. A MitM or sniffing attack can just send the hash and log in. It doesn't actually protect the user at all unless they're re-using the password elsewhere. This also assumes that you're using a seeded hash of some sort, or a multi-round hasher with settings unique to every other website. Otherwise you're still going to run into stuffing and collisions. So for sites where the plaintext password is sensitive (password managers etc) that's important. For most sites, it's not inherently wrong not to hash passwords in the browser, though it does protect against password reuse. I'm not saying you're wrong, I just don't think you're accurately portraying the problem you're fixing.