So a database gets hacked, they add MFA and people are arguing about peppering passwords. What about the part on how the hackers got access to the database in the first place?

Passwords are not the only sensitive info that can be stored in a database and most of the time, that info isn't hashed.