It needs to be slow for attackers if the hash gets stolen like was the case with the LastPass breach.