There are a few reasons why I did it this way:

* Most people still use SimplePasswordHasher.
* BlowfishHasher was deprecated in this PR because it ties to one particular algorithm, the idea behind `password_hash` is that you could stay up-to-date with the latest security fixes from PHP. It is better if we don't have to do that ourselves
* People using SimplePasswordHasher will be forced to specify in the AuthComponent `Weak`,  which has a negative meaning. This is on purpose to encourage people to migrate the passwords