That’s the magic of it! You don’t really need to protect the “salting key.” Sure, it makes it harder if the attacker doesn’t know it, but even if they do, they still have to crack the hash (by dictionary attack, or generating a new rainbow table), which is a non-trivial operation.