If you pay enough, you can also get live patches which don't require a restart. This some to other software too - I've done some upstart live-patching in the past to save a cluster. But yeah, if you can afford to just restart part of your service like a normal person, your restarts will come from the kernel update.