How to keep Drupal site code in version control in sync with production code when using drush updates on servers?
You really have two options:


Assuming you are deploying code to your test server by cloning your code base from a service like github then you can always go in the reverse direction for security patches. You can patch your test servers (or even Prod, though thats not recommended) directly, commit the patched changes to your local git repo on your test server and then push that commit to your remote repo on github. On your local development server you can now pull from your remote git repo on github and everything is in sync. 
Alternatively (and probably less optimal) you can patch your code on your test server directly AND you can simultaneously apply the same patch to your local code base. This way the same changes should be made in both places. This method is DEFINITLY not as good because it makes A LOT of assumptions about how well you are keeping everything in sync, but it can work.