There are a lot of live patching solutions available, paid and free. On my Debian systems, I use KernelCare (like $2.50/server/mo) for a hands-off experience, have only had good experiences over the years.

It's possible that you can do it yourself on Debian (maybe look into https://packages.debian.org/stable/kernel/kpatch), but it was a bit labor intensive, last time I checked, as you have to manually select patches to apply.

We all know OP didn't updated his server for 3 years+

I don't see anything in OPs post that implies that.

Nope, but it's so likely, it may as well be assumed.

1000 days of uptime means the server never rebooted for 3 years, since you need to reboot to apply kernel update / firmware update. ( and plz don't mention ksplice ect .. those are not intended for that )

They absolutely are intended for that. RHEL, Canonical, Oracle, SUSE and KC all disagree with you.

How do you update firmware without rebooting for 3 years? And no it's a stupid idea to use Ksplice for that long and I'm 99.9% sure that OP didn't use Ksplice or similar solution anyway, it's just bad mgmt.