Comment to Evernote

Nearly 2 years on from this post and with a serious security incident now on the Evernote timeline, I'm interested if Dave still feels the same about his comments regarding the approach to hashing.

Are comments such as "In the case of internal password storage, you don’t have access to the MD5 hashes" and "the hashed password is never exposed outside of our data center" still valid? The blog post from Saturday explains that "the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords".

Are these two positions mutually compatible? Can you both not be too concerned about the hashing approach because an attacker "doesn't have access to it" yet also acknowledge that individual(s) gained access to user information? The question may sound rhetorical but it's a serious one insofar as Dave was quite clear in his convictions contrary to some concerned responses. Would you (do you?) do things differently now?