In the case of a password hashing function like Argon2, I know that when a weakness is found, you use another password hashing function, wrap it around the existing hashes and calculate the hash of the password directly when the user logs in again.
What happens when a password-authenticated key exchange (PAKE) protocol, like SRP, is shown to have a weakness? Can you wrap it inside another protocol until the user logs in, or do you have to store the verifier data that may be subject to being cracked in case of a data leak?
I am concerned for the case where the password can either be calculated from the verifier or guessed in a reachable upper limit of guesses when knowing the verifier. The issue is that, in case of a data leak, all passwords are stored in a way that it is realistic for someone to crack the passwords. (Compare it with the case that someone is using MD5 for password hashing)