First, using a simple MD5 hash to protect a password is a bad idea from start. See How to securely hash passwords? for details.
Apart from that, you assume that a 128-bit password would have the same strength as the 128-bit MD5. This implicitly assumes that the 128 bits of the password are chosen randomly. This is usually not the case, i.e. passwords are commonly chosen to be memorable and memorizing 32-byte random data (or about 42 ASCII characters when encoded with base64) is not easily done.
By asking if passwords longer than 128 bits are useless since MD5 is only 128-bit you also assume that there is a 1:1 mapping between a 128-bit input and its 128-bit MD5 hash. I don't think that this is a property of MD5, i.e. you would need in some case (slightly) more than 128-bit input to generate a specific MD5 value.
But assuming that the password was actually 128 bit randomly chosen data, that the attacker has no access to the password but to the MD5 hash of it and that this MD5 hash is then used to validate the password - in this case the attacker would need to do a pre-image attack, i.e. find an input which matches the existing hash value. It turns out that this is actually slightly less complex than brute-forcing all possible passwords. According to Pre-image attack on MD5 hash from crypto.se the complexity to find an preimage is about 2123 which is slightly less complex than brute forcing everything ( 2128 for a full search, i.e. 2127 on average) but still not easily doable.