Answer
Grant EXECUTE on the function to PUBLIC — for example, GRANT EXECUTE ON your_password_function TO PUBLIC — a custom password-verify function needs to be broadly executable (not just owned by SYS) for Oracle's profile-password-verification mechanism to actually be able to invoke it when attached to a database profile.