ChangePassword validates the password against the password provider and, if it is valid, sets it on the user. Just as you say it doesn't save the user object though. That would be a violation of the general pattern in the community platform where all CRUD-operations except read-operations has to go through a handler .
So, the method is just a shortcut method for validating the password against the password provider and setting the property, despite the name indicating otherwise :)
Ah, as I suspected. I was confused by the name and the fact that it was a method, but you are correct about the consitency.