Answer
Treat infrastructure-layer patching (the Oracle database itself, and Java/WebLogic components) as the customer's own responsibility rather than something bundled automatically into application update deliveries — IFS can supply the relevant patches on request, but installing and maintaining them on the underlying infrastructure is on the customer (or whoever they've delegated infrastructure operations to).