macOS updates are your firmware updates.

Yes, but you don’t need to do anything special.

Apple doesn’t release separate firmware patches for the MacBook Air like some PC manufacturers do. Critical firmware fixes—Secure Enclave updates, Thunderbolt vulnerabilities, boot ROM patches—are all bundled into macOS updates. So as long as you’re installing macOS updates when they hit System Settings (or Software Update), you’re covered.

The real risk is letting your macOS version get old. If you’re still on Ventura and Apple has released Sonoma with a critical firmware fix, you won’t get it until you upgrade. So the only thing you need to do: turn on automatic updates, or at least check every couple of months.

Just don’t overthink it. Install updates when they come out, and you’re fine.