I don't know what's xo-updater, maybe an external script, but it's not the upstream one from XOA or XO project.
And yes, there is some patches sometime (for xo-server, which is one package of Xen Orchestra).
For example, xo-server in 5.38.0 never landed in XOA, because we did some QA before and found some issues. We patched it, and then we've done some QA again, and then we decided to release Xen Orchestra 5.33. That's why you can have sometimes some surprises from the sources, because it's not officially tested (unlike in XOA)