In the example yes.

In the real world, finding an input that produces the right hash output isn't easy. And because a lot of users reuse passwords (don't do it, but people do), a list of emails and passwords gives you an incredibly lazy and easy to do way to compromise accounts on other sites.

It's actually a really good question. What you're explaining is called a collision, by creating the same hash with different numbers you can succesfully login.

This why some standard hashing function become deprecated and are replaced when someone finds a collision. MD5, which was used a lot to hash passwords or files, is considered insecure because of all the collisions people could find.

Additional to what others have said: The "salted" part is very relevant for storing.

There aren't soooo many different hashing algorithms people use. So, let's simplify the hashing again with the crossfoot example.

Let's say, 60% of websites use this one algorithm (crossfoot) for storing your password, and someone steals the password "hashes" (and the login / email). I could ran a program that creates me a list of all possible crossfoots for all numbers for 1 to 100000.

This would give me an easy lookup table for finding the "real" number behind those hashes. (Those tables exists. Look up "rainbow tables")

Buuuut what if I use a little bit of salt (and pepper pepper pepper) before doing my hashing / crossfooting?

Let's use the pw "69" again and use a salt with a random number "420" and add them all together:

6 + 9 + 420 = 435

This hash wouldn't be in my previous mentioned lookup table. Use different salts for every user and at least the lookup problem isn't such a big problem anymore.