If a website with old-school passwords gets hacked, the hacker only gets salted hashes of passwords - this does not seem to be much worse?

(Websites that store plaintext passwords surely won't implement passkeys either...)