Comment by harshreality

a) Depends on what hashing algorithm is used (and whether it incorporates a salt). http://hashcat.net/oclhashcat-plus/#performance

b) Because it's hard to secure a corporate infrastructure, (i.e., making a good set of usability/security trade-offs), and there's no such thing as perfect security. A web application that's been audited can still have a security flaw that enables disclosure of authentication data. Or an employee's machine might be compromised, leading to a compromise of corporate infrastructure or data that he/she is able to access.