Eh, "We've got lots of users so it will take a long time to crack them all" isn't much of a defence.
I mean, if you've got Obama or Snowden or Taylor Swift or Logan Paul or whoever as a user, you think hackers wouldn't spent 2 hours of GPU time per account to crack their passwords?