> The additional hashing weakens the credentials.

If it's true, the attacker just has to do additional hashings to crack the password.