Because $password isn't the original value. It should be a hash written when the password is set and the original is thrown away.
if date < '2016-01-01'
return newly_hashed == new_hash(old_hash($password))If a DB has an old hash, call it V1 obtained as H1(password), one can apply a newer hashing scheme H2(V1) and save V2. To avoid having two classes of users forever one can always apply H2(H1(password)) for new users.
It appears though, that this is not what dropbox did, when they changed the scheme to H2 in 2012, applying H2(password) for new users instead.