I think I address this in the article. If an attacker gets the DB dump of your "perfectly crypted" passwords, they can still bruteforce the easy ones (or sites

I think I address this in the article. If an attacker gets the DB dump of your "perfectly crypted" passwords, they can still bruteforce the easy ones (or sites would not tell users to change passwords, no?) while with pepper it would be really impossible.