if my memory is correct this is because they don't have access to $password; they get md5($password) from the client and to store that in the database with a salt need to run md5() again.
oh ok I thought the usual MO was:
if (md5(password + salt) == stored value) ..
It is, but if you don't have the naked password available at the time that you got your hands on the salt? May as well still salt it.