Because the attacker is in a position to query the database. That (probably) means that they have compromised one of the machines that can legitimately query the database. But if that machine can query the database, and the data in the database is encrypted, then that machine must be able to decrypt it, or else it can't use it. So the keys must be on the machine - and the attacker has compromised that machine. Or else, that machine has authorization to send requests to some other machine that is the decrypting authority - and the attackers, by having compromised that machine, have gained the ability to send requests for decryption.

TL;DR: If a machine can actually use the data in the database, it has to be able to get the data in a decrypted form. If an attacker compromises that machine, the attacker can also get the data in decrypted form.

All the best locks in the world doesn't help one iota if your attack is to get the janitor to open the gate for you.

The compromised component at Equifax was the running application which is built to retrieve data from the database - it knows how to log in to the database and do whatever decryption is required to retrieve data. You don't particularly need to compromise passwords or encryption keys or whatever, because the application will just use them for you.

Encryption protects against compromising the server itself either physically or at the OS level, which is not nothing, but also doesn't help if you have an underpaid janitor with a gambling problem with all the keys in his pocket guarding the loading bays out back.