Hi tkalfaoglu,
IF the customer gave you the right to update/upgrade/patch his/her content, then you are allowed to update/upgrade/patch wordpress and/or plugins and themes.
You only have the right to update/upgrade/patch the customers content without a specific permission, if a non-update/upgrade/patch is a security risk to the server.
( These informations are just to inform you about the legal rights! )
You never can be sure, that a wordpress - plugin/theme ( or their updates/upgrades/patches ) is "safe", or could lead to issues/errors/problems, because the plugins among themselves, can also cause issues/errors/problems, as well as updates/upgrades/patches could change the content - layout. From my point of view as a hoster and therefore
service provider, I would never dare to interact with the customers content, when he/she doesn't explizit ask for the interaction
in every single situation.
Exceptions are ONLY server - safety - relevant interactions, as stated above.