I can give the quantum of the benefit of the doubt and assume that they're just possibly overly defensive for SQL injections if they're using the DB to do the hashing. They should be using parametrization anyhow and HAND, but maybe they missed that memo.