password_hash defaults to bcrypt, and Argon2 is opt-in

7.2 added Argon2i to password_hash, and the useful detail is that it did not change the default. Code that passes PASSWORD_DEFAULT still gets bcrypt, deliberately, because the default is allowed to change between versions and a stored hash has to remain verifiable.

$hash = password_hash($plain, PASSWORD_DEFAULT);   // bcrypt in 7.2
$hash = password_hash($plain, PASSWORD_ARGON2I, [
    'memory_cost' => 1 << 17,   // 128 MB
    'time_cost'   => 4,
    'threads'     => 2,
]);

// and the line most applications never write
if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
    $this->store(password_hash($plain, PASSWORD_DEFAULT));
}

password_verify reads the algorithm out of the hash string, so a database can hold both while a migration runs — there is nothing to coordinate. The line worth adding is the rehash check inside the successful login path, because it is the only moment the plaintext is available. Without it, a cost increase applies to new accounts only and the old ones stay at whatever was cheap in 2013.