Note: I didn't read/understand your earlier post fully. My responses are only related to the quoted post.
OCLP is set to auto start up, and if it detects that your system needs root patches, it will prompt you. But that can sometimes fail to detect. In the case where you know the system needs root patches but OCLP does not prompt you, you can manually open up OCLP and install the root patches.
That is correct. The bottom setting references Apple's Rapid Security Response. There were confirmed precedence where installing an RSR in an OCLP system would prevent the system from booting due to the way RSR messes with volume signing. That is to say, IF Apple releases an RSR anytime in the future and you install it, it is highly likely your system will fail to boot with OCLP. The reason why you don't see any prompts or any uninformed user complaining on forums is because Apple has only released RSR twice to the public since its introduction more than a year ago, and after the subsequent public update it would no longer be possible to receive such an update.
The low frequency of people running into this issue is due to Apple's own self restraint in (not) releasing RSRs.