Password Update form accepting any data for currentPassword
If the user already has an elevated session then they do not need to enter their current password. You can see the relevant code for this check here:
https://github.com/craftcms/cms/blob/bd3820f19a0680c635a89c7f16805299964d97f2/src/controllers/UsersController.php#L1713-L1721
That is the only explanation I can come up with for the difference in what you are seeing locally and in production.