I think this is intended for the case where a database has been compromised, but then again, I thought that hash algorithms and salting were supposed to deal with that.
Either you have some EXTREME legacy or lazy engineers. Doing it right doesn’t take long.