Packagekit (at least last I heard of it) was just a higher level package manager (wrapping around dnf/apt/etc), not anything specific to kernel patching. Maybe that has changed?
You can live patch a kernel, each distro has their own way of doing things, usually, you get a kernel module that is loaded that fixes the bug live, and there is a real fixed module to go with it that gets loaded next boot. The kernel patch module is just a hack to avoid rebooting. Ubuntu has some doco on their system LivePatch which is worth a read. I am not sure that kernel module signing is super commonly used, but there may be some distros that ship with it enabled. If it is enabled, then loading an unsigned kernel module should be impossible.
As for trust a modem, thats a tricky one. Firmware level hacks have been theorised for a long time, but there is very few examples of actual exploits. Its mostly security through obscurity.