As far as I know, that is correct.[1] Any change, whether for work factor or algorithm in code still waits for the user to come back and attempt a login, at which point you update the database stored attributes and the hash.

I think that if you can update a user's password without them inputting, then you have two problems.

[1]not authoritative advice.

edit: seems that comments suggest doing the md5(bcrypt(hash)) can be used to upgrade across the board