I think I see what you're saying but how would that be useful still? Like is an attacker has a hash of the users password they still don't have the server secret.