You cannot avoid recycling the workers if the bug is in the binary. You can avoid doing it to every user at once.
Add a patched instance, verify its PHP package and a health URL, then shift the load balancer. Drain the old instance. This works for VMs, containers, and a second FPM pool on a new socket if you switch Nginx only after the new pool is proven. Switching the socket before the new pool answers is an outage.
For a single server, the restart is short and real. Announce it. Raise pm children only if you know the memory cost. memory_limit=-1 as a temporary CVE setting increases the chance one request consumes the machine, so do not combine it with a casual children increase.
Opcode caches clear on restart. The first requests are slower. That is not a failed patch.
Database migrations are a separate release. Do not mix a schema change into the PHP security window. If the new PHP fails, you want the old PHP and the old schema together.