In addition to the information provided by AndriyBilous.
They do not update WordPress. They do update underlying Linux, PHP, Nginx. Excerpt from article (link below excerpt):
The updates for Linux, PHP, and Nginx are installed automatically. New WordPress versions will be available for new deployments within two weeks of release. For existing deployments, you will have to upgrade your WordPress version yourself.
WordPress on Azure App Service - Top features you must know about
This is old/outdated article, but contains some helpful information in regards to PHP update policy:
In regards to notification/alerts/lead time, in general it is 7 days for multi-tenant app service, and 15 days for App Service Environment v3. Please see articles below:
Routine Planned Maintenance Notifications for Azure App Service
Upgrade preference for App Service Environment planned maintenance
For more control you may consider running a custom container or using IaaS VM (as you mentioned).