I'm using an XZ1C with 17.1 myself and am keeping that updated as much as possible. This includes security patches and kernel patches and updates. I also included some stuff I need for myself (e.g. the SafetyNet fix w/o Magisk to use GooglePay) But I'm not really doing any development, e.g. adding new features beyond that.
What I do for 17.1 I also add to 18.1 but I have no way to test that myself as I only have that one device, hence the disclaimer at the top. Adding stuff or fixing bugs in 18.1 is hence to dangerous for you guys, as I won't know if that bricks your phones. So I really only add what I tested in 17.1 and assume to be fine in 18.1
TLDR: 99.9% security patches only. The ROM is already stable enough thanks to the original authors.