Yes - we’d notice if an Apache instance went down and restart it.
We don’t run Sendmail on any shared or dedicated customer machines (we use Postfix primarily), but yes - on manged dedicated servers, we take care of software updates, including security updates. In general, Debian is quick to respond to security holes, and so with most software, we simply track their security updates. With stuff we build ourself (Apache, kernels, MySQL, PHP), we build / test new packages and push them out when necessary.
Feel free to contact our sales team if you have any questions.