Yeah, not too worried about that. login() is not called that often compared to the rest of other actions in a typical app.
Also the implementation of password_needs_rehash() is quite light internally