We aren't required to follow a certain direction, but I know 2 years ago NSA & NIST essentially said use 8 because 9 wasn't yet vetted. Cisco had or does recommend type 9. What did you go with?
Finally upgrading from the ones you can just paste and see online. From quick testing, it looks like just using command, "username <user> algorithm-type sha256 secret <pass>" would be the safest way to overwrite the old user of the same name but with the better protection with no downside of it accidentally being cleared first but then not supporting the command such as in the case of old switches