It's more an assumption I make to help guide how I build applications. Put another way, I wouldn't bother hashing the user password if I expected that I would always perfectly prevent all unauthorized reads from the database.

If someone knows that my application will just use the last 10 characters of the salt for a password reset token and they initiate the password reset for a user, they can potentially use the data from last month's breach to reset a user's password.