I had the same question. Why the password_hash (or salt) still set in DB for an account registered through OAuth providers (I use Discourse OAuth2 Basic plugin). My experiment proves that users are able to login (if one doesn’t disable “enable local logins” when OAuth2 is enabled and setup) through their local password that set through reset password functions in their preference panel. They can also login through their OAuth2 providers credentials. Both mechanisms are allowed as pfaffman said.
I’m curious what’s the initial raw value of password_hash?