You're confusing the AES encryption with key derivation.
If you use key derivation mechanism that derives the key from a password then the effective strength of the resulting encryption is the weaker of both the encryption and key derivation step.
If your password contains less than 128-bit strength (this is equivalent to about 21 characters passwords randomly chosen from a 64 character set, or about 9-words diceware passphrase), then yes your derived key will only have at most that many bit of strength, thus AES-256 will not improve on AES-128. But if you have a stronger password, then 256-bit AES can preserve more of the strength from the original password.
Mathematically, AES-256 is harder to crack than AES-128 when used with appropriate key derivation and password generation. Although in practice, 128-bit is already practically not brute forceable, so in practice using more than 128-bit passwords is overkill for most situations. The main purpose of 256-bit passwords and AES-256 is really just to increase the security margin of the scheme if it turns out that there is a cryptographic flaw that reduces the strength of the system.
Also, there are a lot of applications of AES where the key is not just derived from a password. For example, if the key is stored in a secure cryptoprocessor/smartcard, which can enforce lock down policy by forcing delays between attempts. There are also hybrid schemes where the system generates a 256-key that is then encrypted with a password, and the encrypted key is not stored together with the data, so that opening the encryption requires an out of band header.