> You’re assuming an attacker can access this database somehow?

Well yeah. Protecting against this is the exact reason passwords aren't stored in plaintext.