A little bit simplified, it works like this:
weaver_token = GetFromSecurityChip(profile_id, H(your PIN or passphrase + "some static string")
hashed_passphrase = H(your PIN or passphrase + "some other static string")
decrypt_key = H(hashed_passphrase + weaver_token)
disk_encryption_key = Decrypt(data=encrypted key stored on disk, key=decrypt_key)
In other words, the disk encryption key itself is stored on disk, but it is encrypted by a key derived from your current PIN or passphrase.
When you change your PIN or passphrase, the disk encryption key is decrypted with the old PIN or passphrase (old hashed_passphrase above), and then re-encrypted with the new one. I assume a new weaver token is generated and stored on the security chip. The actual disk encryption key itself doesn't change, and doesn't need to change.
The old version of the encrypted disk encryption key is supposedly erased from disk in a secure way. I am uncertain how this is implemented, since you in general cannot securely erase things from flash based storage. The old weaver token is also securely erased from the security chip, in a way that makes it impossible to recover. This should be actually secure, and is thus also what provides the actual security, as without the weaver token, one cannot decrypt the disk encryption key even if one knows your PIN or passphrase, or in this case, your old PIN or passphrase. This of course assumes they generated a new fresh weaver token, which is a detail I am not certain about, but would reasonably assume.