Isn't the point that the old hashes are out there somewhere and if cracked would reveal the plaintext password? This would then allow the attacker to access the compromised account since the password itself has not changed even if hashes are updated by doing newScheme(oldHash).