How to update Twig - does it need to be updated?
Drupal core may update that dependency if it complies with the Allowed changes during Drupal 8 release cycle documentation page. A library may be updated to a more recent version in a minor release of Drupal (such as 8.1.0 or 8.2.0). Any feature requests or bug reports should be discussed in the issue queue for Drupal core.

Composer dependencies do not update automatically, but are based on running the composer command on the composer.json (or lock file).

However a contrib module may add its own Composer dependencies, which could alter dependencies added by Drupal core outside of a release. Composer looks through the entire dependency graph to choose a version to install, and this might update Symfony or Twig or Behat for instance. You can learn more about how Composer deals with semantic versions, which is similar to npm (node.js).

It is probably not safe to update to an arbitrary version of Twig because that may break core or contrib, but it is possible to update to a compatible version without waiting for an update in Drupal core.