I believe this is what's happening now (though can't find any confirmation from Apple):
In the past, you would enter your password and the iPhone would store is locally in some kind of reversibly encrypted form. When it needed to access your email it would un-encrypt your password and send it to the server. Storing your password is a security hole.
What probably happens now is that when you first create your account (or when you first upgrade to the new client), the iphone does not store your password but sends it directly to Yahoo and gets back what's called a token (actually probably two - an access token and a refresh token but that's a different discussion).
The iPhone stores this token which is only usable by it and when it accesses Yahoo it sends this token in place of a password. When you change your password on Yahoo, the iPhone doesn't care because Yahoo 'knows' the iPhone had the right password when it first got its token, so the iPhone continues to work. If you no longer want your iPhone to be able to access your Yahoo account, go to your Yahoo account and delete the entry for the iPhone.
One issue is that Yahoo help claims you can delete apps under the Account Security menu but you actually have to go to Recent Activity, as another user posted. Also, instead of using the name of your iphone it just calls the app 'iOS' which will be confusing if you have multiple Apple devices connected.
==========================================
I believe something like what this user posts is probably correct.