So, I know BAM will only find/attach project accounst that have the same password as my BAM account, but do I have to keep them the same after the account has been attached?

If you want to keep managing the project with BAM!, then yes.

What does managing include? A new install of BOINC picked up my WCG account upon connecting to BAM, even though the passwords are different.

Read the info about BAM! and the BAM!-FAQ, it's (nearly) all there...

Unfortunately I am interested in the bit that is not there, specifically what functionality of BAM is impaired if my project passwords are not the same as my BAM password. I know that attaching projects to hosts works (Just tested it with SETI@home), and so do the stats, so clearly some parts function properly without matching passwords.

Updating computing preferences, updating account info and team functions will fail.

Statistics are not part of BAM! so will work always.

Thanks! You may want to post this to a FAQ somewhere, because using the same password for many sites is an issue for some people.