I’m not sure what type of auto-update checker you’re referring to but with Xanmod it’s still installed from a Debian repo and updates with the rest of your system, so if you use e.g. KDE’s Discover software center it will still alert you when it finds that the Xanmod kernel can be updated. Personally I just update everything whenever I reboot my system and at least once a week otherwise. There is usually nothing to update with Debian, so this isn’t a big deal.

As for security patches I might need extra guidance on that - since Xanmod is inherently built from mainline Linux source I don’t think it needs security patches? Kernels like LTS Linux or Debian Stable’s still want the newest security patches from new kernel source code, so those have to be manually extracted from the newer kernel source and backported into the old codebase. With something like Xanmod there’s nothing to backport because it’s always got the newest source and all the current security updates. You can think of Xanmod like linux-zen on Arch Linux - it’s just a fork of the original kernel with a couple extra tunings.

Edit: Actually from my understanding, linux-zen from Arch Linux is equivalent to the Liquorix kernel, if you want to use that instead of Xanmod. I don’t really have a strong preference between the two.