In Flarum the choice was made to use the password reset feature as the main way of changing password as well. I'd guess this is because it reduces complexity and development time for now.
This method of changing password, that is common in modern web apps, relies on the second factor that is email to prove account ownership and prevent yourself (or a hacker) from locking you out of your account.
To add a standard change password feature, you'll need to write or get an extension written.
This still leaves the question of how you verify the legitimity of users and how do they recover access to their account if they forgot their passwords or get compromised ?
