Figured it out. In case anyone else is wondering, you have to pass the entire payload. So first read the identity and then construct something like this and then it updates the password alright:

const identities = await oryIdentityApi.listIdentities({credentialsIdentifier: user.email});
      
        const identity = identities.data[0];
        const request = { 
            "id": identity.id,
            "updateIdentityBody": {
                "schema_id": identity.schema_id,
                "traits": {
                    "email": identity.traits.email,
                },
                "state": "active",
                "credentials": {
                    "password": {
                        "config": {
                            "hashed_password": bcrypt.hashSync(userParam.password)
                        }
                    }
                }
            }
        };
        await oryIdentityApi.updateIdentity(request)
            .then((res) => {
                console.log(`Successfully updated password for user: ${user.email}.`);
            })
            .catch((err) => {
                console.log(`Could not update password for user: ${user.email}. Error: ${err}.`);
                throw err;
            });