People may be “OK” with that, but: No, it is not “OK”.
Definitively NOT.
Still NOT, a big NO.
Installing ANYTHING in dom0 is an obvious hole in the security and against logic of Qubes OS.
Yes, that the real question.
NO, packages in dom0 ARE NOT AUTOMATICALLY UPDATED.
That the reason why dom0 is based on an EOL (end of life) version of Fedora.
Even if it was (or will be) based on a non-EOL Fedora version, the packages will
not be updated for obvious security reasons.
Only packages provided (and reviewed) by the Qubes team will be updated.
If your serious about security, do not install anything in dom0.
For now, you need to trust Xen and Qubes team.
If you install X in dom0, the trust and security of your whole system is now transfert to X,
BEFORE Xen and Qubes team.
Please, do not give bad advice to people (Especially to beginners / non-tech users).
The target of Qubes OS are mostly non-tech users, therefore, all of your advice are bad.
No ofense, but when you reply, you must think of future readers, especially those who will
not read the docs because of lack of knowledge or time. Thank you.
As mentionned by @adw , it is your computer.
Adjust according to your threat model (and knowledge).