By using this kernel, will you be able to automatically receive security upgrades in the future? Or will you have to apply them manually and then recompile and install the kernel yourself?
Is "developers have to apply security patches manually, then recompile and reinstall the kernel themselves rather than automatically" not a big deal in practice?
It's not a big deal, because you can automate it. As long as the patch applies cleanly (and it almost certainly will if the only vendor changes are security updates), it's going to be a pretty smooth process.
You'd need to test the new kernel before deploying in production, of course, but you'd be doing that before rolling out a vendor provided kernel change, anyway.
Is "developers have to apply security patches manually, then recompile and reinstall the kernel themselves rather than automatically" not a big deal in practice?