Why not simply update the service with new password an start it?
Best to run this service with account that has password set to not expire.
The role the VCS helper account is explained over here:
and in context of a Service Group:
So, if any DNS updates are needed during a failover, this service/account is needed.