comp34.tgz necessary on a firewall?

[e.conti@gmx.net]

After having installed OpenBSD a DMZed server, I'm going to use install it on 
a firewall. However, there's one thing I need to understand before doing so.
Used to Linux Debian, I use apt-update && apt-upgrade to keep my system 
up-to-date. On OpenBSD, updates seems to require downloading a patch and 
recompiling the application/kernel to update.
Therefore, it seems necessary to have a compilator installed on the system. 
This is, in my opinion, a very bad idea for a firewall (even if it's a 
bastion-type firewall).
Do I really need to install the comp34.tgz package on my firewall to keep it 
up-to-date? Aren't patches available in a package/binary form?
How do you guys cope with this problem? Do you apply patches on another 
computer and transfer the binary files to the target computers later?
Thanks for the help.