Yes, if an attacker compromises the database they can send the direct hash.

The point is that a malicious or badly-secured site can't use your password on other websites, because ultimately most people use the same password on many different sites.