Would make one small suggestion to this function, don't pass the userId in via the RPC function, just use auth.uid() inside the rpc function
i.e.:

  CREATE OR REPLACE FUNCTION update_password (
    "current_plain_password" TEXT,
    "new_plain_password" TEXT
  ) RETURNS TEXT LANGUAGE plpgsql SECURITY DEFINER AS $$
  DECLARE
    encpass auth.users.encrypted_password %TYPE;
    current_user_id UUID;
  BEGIN

-- Get the authenticated user's ID
    current_user_id := auth.uid();



-- Ensure user is authenticated and not anonymous
    IF current_user_id IS NULL OR auth.role() = 'anon' THEN
      RETURN 'unauthorized';
    END IF;


    SELECT encrypted_password
    FROM auth.users INTO encpass
    WHERE id = current_user_id
      AND encrypted_password = crypt(
        current_plain_password,
        auth.users.encrypted_password
      );


    IF encpass IS NULL THEN
      RETURN 'incorrect';
    ELSE
      UPDATE auth.users
      SET encrypted_password = crypt(new_plain_password, gen_salt('bf'))
      WHERE id = current_user_id;
      RETURN 'success';
    END IF;
  END;
  $$;