How can a hash function be suitable for hashing passwords, but not for deriving enctyption keys, and vice versa?
So the requirements to a hashing function for hashing passwords seem to be the same as the requirements to a hashing function whose output is used as encryption key


This is correct only when the encryption key is derived from a password.

The similarity you observe is due to the fact that a password is the input, and passwords tend to be relatively easy to guess.

Other circumstances where encryption keys are derived do not require key stretching, because the input is already an unguessable (psuedo)random value. 

As an example, when using a key agreement scheme the resultant shared secret is typically hashed with a fast cryptographic hash function such as SHA256 to protect the private keys in the case that the shared secret key is compromised. Since the value is already random and large enough to be unguessable, there is no need to apply a slow hash to prevent the adversaries ability to guess it.

tl;dr

If the input is a password, then the hash needs to be slow to prevent an adversaries ability to perform exhaustive search on the entire password space. 

If the input to the hash is already a large random value, then slow hashing is not required.