Some teams deploy WordPress or other applications by pulling code from a repository directly onto the server. This gives a clear history of changes and an easy way to roll back.
It also changes who is responsible for patching. Tools that detect a checkout may stop applying automatic updates so they do not overwrite tracked files, which means security updates must be committed and deployed by the team.
Include update steps in the deployment process, remove or block the repository metadata folder from public access, and verify that the running site actually contains the patched versions after each deployment.