I see. I post these questions while writing the Yii 2 code and reviewing the latest Yii 1 code.
If we keep same(), it should be made protected or private unless we intend to expose CPasswordHelper::same() as a public API. Still, since after simplification same() only contains a few lines of code, it is better to just insert them in verifyPassword(). The comment can go with them.