When we state that "SHA-256/SHA-512" hasn't been broken, what we mean is that the three security properties of hash functions haven't been violated. Those properties are:
Preimage resistance; given a hash, value, it is hard to find a string that hashes to that value.
Second preimage resistance; given a message, it is hard to find a second message that hashes to the same value that the first message hashes to
Collision resistance; it is hard to find two different messages that hash to the same value.
Where "hard" means both "the best known attack are the known generic attack" and "infeasible with the computing resources currently available".
Now, you might say "I can precompute a 10 character password hash; if I see that value in the password file, haven't I violated preimage resistance?" Actually not; that is a generic attack, and would be applicable to any hash function.
What this observation would imply is that unsalted SHA-256 or SHA-512 probably isn't the best choice to storing passwords - as you said, you can precompute things (or even better for the attacker, generate a rainbow table). What you should do is a) add salt (so precomputation attacks and multitarget attacks are not applicable), and b) use a hash function that can't be computed as quickly by the adversary (such as Argon2)