Perhaps the attacker was only able to download a read-only copy of the database.
So sure, she can see all the other secret data stored in the database, and compared to that the passwords may not have much value.
However, it is only by impersonating an actual user to the live system, that she would be able to affect changes - e.g. changing the balance in her account, inserting records, and performing any business functionality supported by the system (other than simply reading data).
Depending on the system, there may even be other subsystems it talks to, and not just storing in the database. If that is the case, then even if the attacker is able to update the database, some of the external functionality may not be available without impersonation. And that's what you need the password for.