Correct.

Even a million rounds of hashing only adds 20 bits of security. No need if your secret is already 128 bits.