It's not a big deal, because you can automate it. As long as the patch applies cleanly (and it almost certainly will if the only vendor changes are security updates), it's going to be a pretty smooth process.

You'd need to test the new kernel before deploying in production, of course, but you'd be doing that before rolling out a vendor provided kernel change, anyway.