>then a hacker stealing password hashes would enable them to instantly log in, without cracking them

How do you know the hashed value stored in the database is the same hashed value the user submitted? Server side I can add a salt and hash more before storing or comparing.