When Wireshark puts out a security patch, is npcap included, if necessary?
We don't put out "patches", per se; we put out new dot-dot releases, with a full installer. That installer is. as Jaap notes, bundled with an Npcap installer. If the previous release in that series (for example, for 3.6.1, the previous release would be 3.6.0) didn't bundle an installer for the current version of Npcap, we might bundle an installer for the current version with the update release, but there's no guarantee of that.
Similarly, if npcap has an issue, does Wireshark put out a patch since npcap is included in the Wireshark installation?
We don't tend to issue a dot-dot release solely because of an Npcap update, although we might include a newer version of Npcap in a new dot-dot release that we put out to provide fixes to Wireshark.