I'm fairly sure that patches are included in a .1 update (for example, 4.19.1 is likely to be released soon) but I was wondering if the passive approach to updates I am now able to have as a Cloud customer also applies to patches? Can I assume that a patch is included if I update to 4.1.19 right now or do I need to wait for 4.1.19.1?

There are now four files included in the patches. I know you only need them if you have problems but I have become quite comfortable with updating on a regular schedule, usually 10-20 days after the update is released, and have yet to run into any problems as a result of the update. It would be good to know if this can continue with patches taken into account, since the latest update is relatively small.

We are working on an intelligent patching system, hopefully for 4.2. As it stands, we generally do not hot patch an active release - downloadable or hosted - except in the rarest of circumstances. While we do not apply automatic updates to cloud clients (but we do for enterprise/managed) for various reasons, including the potential for breaking customizations when you may not be around, we expect to make this even easier moving forward. 

Sounds good! I'll wait for the next update.