That wouldn't be the case in many scenarios I can think of:
1. DB backup is compromised (from an offsite backup storage, think S3).
2. Developer laptop lost, with a copy of the database locally. (source code may be available, but the site-specific key probably wouldn't be. As that's a config var on the server).
3. SQLi that dumps hashes to the page.
I'm a big fan of making the job harder for attackers. There are lots of attack vectors where a 'pepper' value would be useless. But not all of them. And it's nearly free to implement. Might as well.
1. DB backup is compromised (from an offsite backup storage, think S3).
2. Developer laptop lost, with a copy of the database locally. (source code may be available, but the site-specific key probably wouldn't be. As that's a config var on the server).
3. SQLi that dumps hashes to the page.
I'm a big fan of making the job harder for attackers. There are lots of attack vectors where a 'pepper' value would be useless. But not all of them. And it's nearly free to implement. Might as well.