I would think we'd be able to detect some existing passwords based on hash length and the current auth provider selected before the update is done.

There should only be two password formats in the database, 3.0 style and the style of whatever auth provider was used (there could be more from other conversions during the board's history, but those users wouldn't have logged in for a very long time). Anything besides those styles we can just ignore and those users will just have to reset their password if they want to log in.