Except attackers usually get the passwords from other sites' databases that do the same thing and don't use proper backend hashing/salting