Upgrading, yes, Magento already performs installer scripts to apply DB and/or data changes. If you are "doing it the right way™" you should have a local copy for reach dev, a development environment, and a staging environment. If you are a one man operation, staging may be overkill, but as easy and cheap as it is these days to spin up a cloud server there's really no reason not to.
Simply apply the .sh patch or even a fresh thx and overwrite on top of your installation from your local instance, create a new git branch, and test away. There are many testing frameworks to utilize like selenium, magetest, unit tests, etc. to throw out your now patched code base. If asks all, then commit the branch, and if you are doing continuous integration, you shouldn't need to do much else, as to treat it just like deploying a commercial or local module.
The most difficult part is regression testing, make note of what the upgrade is fixing/adding/removing, etc. To help narrow down pain points to focus more on. And there's always good community efforts to help others with upgrades and patching on here at MageExchange.
But with that said; security patches coming in various flavors requires a bit more of a manual process. Since Magento usually gives patches in an "supposed" easy way to apply them. Most of the patches are just the same bash
.sh scripts that wrap the Linux
patch command while embedding the generated
diff changes. You can cherry pick the diffed embeded code out and store it in Git or such & use a means like a webhook to trigger applying them with patch.
One thing computers are great at doing is repetitive tasks, anything doing twice is worth automating. Hence the reason everyone loves & strives for clean readable code. Plus you should be coding as the next guy to inherit the technical debt, is a psychopath and knows where you live. 😀