The threat model is that attacker stole your database backup and is now trying to brutforce passwords in it, by computing all plausible permutations of characte

The threat model is that attacker stole your database backup and is now trying to brutforce passwords in it, by computing all plausible permutations of characters, hashing them and seeing if they hit a match. Because attacker is attacking a mass of passwords, he is likely to use a parallel computer, such as a GPU or an ASIC, to decrease the cost of he attack. The defense against this scenario is to make hashes expensive to compute and hard to parallelise. If an algorithm is using a lot of RAM it's hard to parallelise because a piece of RAM can be used by only one computation at a time, hence this algorithm is hard to attack, but your own server is computing things sequentially as users come online, so a single piece of RAM can be freely reused. This is why low RAM usage is bad. I did not quite get the idea behind the ROM thing, but I think it means you have a large multi-GB piece of strongly random data, which is used during hash computation either entirely, or piecemeal where pieces are picked pseudorandomly and not predictably. A GPU cannot store multi-GB chunk of data, so it will have to travel externally to fetch required data, which is easy to do for a sequential machine, but creates a huge bottleneck for a GPU, making parallelism hard again.