Anyone finding this in future and asking if it's safe to remove the plugin from WP 6.8 and up if you've been using it on earlier versions see this comment. Copied and edited for context, below.

John Blackbourn
"[Y]ou can either remove it or leave it in place. If you remove it then the plain bcrypt password hashes that were created by [roots/wp-password-bcrypt] are supported by WP 6.8 and will be upgraded to the $wp-prefixed versions the next time each user logs in or resets their password."