How can the user change the password ( lets say to make it stronger) without resetting it first?

There evidently is work underway to support this....maybe: https://github.com/supabase/supabase/discussions/4773 Then there is this link I participated in to create a function to do that with encrypt extension: https://github.com/supabase/supabase/discussions/4042

Not sure if this works https://supabase.com/docs/reference/javascript/auth-update#update-password-for-authenticated-user

I will try, but is it not a security risk to not ask for the old password?

Depends if u think the access token is by itself sufficient