How long should it take for developers to upgrade from Magento 2.2.6 to Magento 2.2.8? We have been told 18 hours but that seems a bit too much.
Any estimation without a code audit is useless. And anyone who gives you one(without a code audit) should not be trusted.
That being said there are multiple factors to take into account.
How much custom code do you have? A big amount of custom code can increase the estimation.
Who gave you that estimation? If I'm seeing the code for the first time I need to first understand what is happening there and what to test afterwords. It might take a day only to install the project locally, depending on how big and complex is the application.
If developers in charge with day to day development have to do this task it should take them less than it would take a person who never saw the code.
How many environments do you have? The upgrade should be tested on each environment.
Who is in charge of the deploy on production? Is that included in the estimation? You could ask for a more detailed estimation.
Are there changes made in the core? (If someone is horrified by this question, not everyone is as professional as you) Changes directly in the core increase the upgrade time significantly.
To sum it up 18 hours might be too much or it can be not nearly enough. What you could do is ask a more detailed estimation. How are does 18 hours broken down, how do they justify those 18 hours. You could also answer some of the questions I put.
Then someone might give a more helpful answer.
Generally speaking, if you stay within the minor version (2.2.x to 2.2.y) there isn't a lot of risk as these updates should only add features, define future deprecations and fix bugs / security issues. Depending upon the method of installation it can take 5 minutes to update the core to 20 - 30 minutes to merge the differences.
Either way, you will still want to validate any external extensions you've had installed from the marketplace and upgrade them. You'll also want to validate your custom modules don't break because of security and bug fixes. Finally your themes will also need to be checked to make sure that they support any new features or include any frontend fixes the core may include.
If you're not using anything but a custom theme 18 hours is potentially way too long. I would devote at least 1/2 a day (about 4 hours) to do the upgrade and basic functional / user testing to make sure things are okay. As you add modules and customizations then that number will only go up. Without knowing your exact environment, it's hard to know if 18 hours is out of bounds or reasonable.