It does stay on the device; the iPhone passcode is entered and authenticated locally, then the iPhone authorizes the AppleID password change since you're "authentic."