> most software in the world uses a basic hash like MD5 or SHA-256 rather than a key derivation function

For passwords? Where do you get that information?