Debian based systems will change some config files on updates; I had a systemd customization that was overwritten out from under me, and I evntually found there was one place for apt to manage and a different for me to manage.
The only place where a package manager should overwrite changes is /usr. If you made any changes inside /usr, then yes, it'll be overwritten. A user isn't supposed to mess around inside /usr, unless there's a very good reason for it. There's /usr/local but it's better to just use $HOME/.local instead.
And of course you can do anything you want in a postinst script (again setting aside policy)
The whole point of Linux distributions is having policies to protect the end user and enforcing them.
(can you tell that I've shipped Debian packages before?)