My reasoning was that if you can capture the hash, you could have also captured the password but that doesn't account for a situation where the database is comp

My reasoning was that if you can capture the hash, you could have also captured the password but that doesn't account for a situation where the database is compromised.