I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible. And if you somehow by luck or knowledge get into the vault there are secondary, third, etc security procedures in place such as alarms, self-locking doors, cameras and heat/movement detectors.
A database is a vault. It's for storing things you don't want anyone to be able to access and even if a hacker can access it, they shouldn't be able to do anything with the data that they can see.
Banks get robbed all of the time, but the damage is minimal because the cash available over a counter is a write-down for a bank that keeps most of it's wealth in a vault onsite or offsite.
Bank vaults versus databases are entirely different.
A bank vault can be locked down. It's only accessible for a small set of hours per day and access is only given to a small number of people. People also don't need random access to a bank vault.
Website databases are more like cash registers. They need to be accessible 24/7 and nearly every transaction requires accessing it. Any person off the street is allowed into the store and you also have to trust the person at the register to know what they're doing. Even if you cover the case in lead, it still needs to open when a customer comes in.
It's also important to note that Blizzard did have the digital equivalent of "alarms, self-locking doors, cameras and heat/movement detectors". Many other data breaches haven't been noticed for months, if at all. Blizzard have responded in a timely manner, likely due to internal digital tripwires.
There is a far closer digital example to a bank vault and that's a Bitcoin wallet[1]. You have a hot wallet that's accessible via the server with enough money in it for most transactions and then a cold wallet that requires a person to interact with it (i.e. decrypt) for it to be of use. In the spate of Bitcoin server breaches, those implementing hot/cold wallets only lost the "cash available over [the] counter".
A major site storing authentication data should store it in a separate physical server, isolate that machine so that administrative access is not possible from the net (NO path from the net through to ssh or console server access to the auth server should be possible... that includes internet -> internal employee machine -> auth storage server). NAT and firewalls are irrelevant, because they do not protect against incoming attacks through tunnels initiated inside.
That may mean physical console only login access, if the general internal network has internet access. That's a necessary usability trade-off something as serious as an authentication database for ten million paying customers.
The authentication protocol to talk to the auth server should only allow simple (easily parsed) requests; they should be rate-limited, there should be no provision to check multiple hashes at a time, and it should be impossible to export hashes out of the auth server without administrative (console) access.
Similarly prudent precautions can be taken for backups of the auth data. The backup server encrypts the auth database, before writing it to an attached disk or whatever the scheme is. Several high-level employees then have usb keys with asymmetric keys, any of which (or any n of which) will decrypt the backups.
You can't air gap the auth server, but you can limit the attack surface so dramatically that you have a high degree of assurance that it's secure against network attacks aimed at authentication data disclosure.
Someone can own the webservers and collect passwords and one time auth tokens, and can compromise 2-factor seeds for users who are just setting up 2-factor, but that's far more limited than gaining access to hashes or seeds from auth servers.
This metaphor seems compelling, but it breaks down when you consider that in a digital break in, nothing physical must be moved. Were vault breaches like database breaches, one would merely have to look at the money to have a personal copy of it. This is a very different security scenario.
A database is a vault. It's for storing things you don't want anyone to be able to access and even if a hacker can access it, they shouldn't be able to do anything with the data that they can see.
Banks get robbed all of the time, but the damage is minimal because the cash available over a counter is a write-down for a bank that keeps most of it's wealth in a vault onsite or offsite.