Gotcha, no, I wasn’t trying to make that claim, it’s just a way to make it more difficult/time consuming

That’s all you can do though, extend the time it takes to brute force, so I’m not sure what the distinction being made is.

If they are following best practices then individual hashes should be salted and the database of hashes should be peppered so even if someone brute forces an offline copy of the hashes they wouldn’t result in actual useable passwords.