The important thing is that the attacker should not be able to brute-force to gain access.
That doesn't necessarily mean that the hashing algorithm has to be slow. The end-to-end login flow should be slow enough. This can be achieved in several ways:
- As you mention, change the hashing algorithm to be slow.
- Disallow login attempts for a certain duration after a certain number of wrong attempts.
- Mandate passwords of greater lengths and complexity. (Greater length increases the number of possibilities to be tried for brute-force attempt)
Option 1 and 2 are of no use if the hacker gets access to the hashed form of the password and the hashing algorithm.
Edited with the suggestion from the comment:
Option 2 is of no use if the hacker gets access to the hashed form of the password and the hashing algorithm.
Option 1 is also useless if the slowness is largely due to sleep that can be worked around (for example if the source code of hashing algorithm is available, then it's easy to delete the sleep. Other options are possible without the source code too)