You have many questions there and most of them are legit but farely hard to answer becasue at the end of the day its the web developer that make the difference,
not all of them are the same in knowledge and not all of them have a good profffesional approach to the busines or to the client.
I'm a wordpress developer for long time now, here is my 2 cents:
1) Do "done for you" website designs have to be updated on a regular basis (asking since WordPress themes are updated, otherwise it would be like not having a license)
It depends on which framework, or starter theme they have built upon, but NO - the theme itself do not have to be updated regurarly, in most cases if you have sopme PHP 7 incompatible code then it should be updated, becasue most of the web devs will create the wordpress website within their local enviroment with all the latest versions of the PHP/MYSQL, and when the website is uploaded to your own hosting then it might trigger some notice or warning , or an Error which will cause the website to stop working, in those cases PHP on your hosting should be upgraded and not the theme itself.
2) How do you edit these websites or are they built on top of a WordPress theme?
You will never have to edit theme files yourself if that what you mean by editting Wordpress theme, a good web developer will set up a backend for you (in most cases they will use Advanced Custom Fields plugin) so that you edit text and images from Post/Page/Archive content editors.
3) Are there any security or speed issues I should be worried about?
There could be but in most cases NO, if the web dev is using establisehed starter themes like: Underscores, Sage, JointsWP, Generic, Start ,HTML5 Blank etc..
4) How to know if the designer didn't fill the code with the garbage that will slow you down or that will cause breaches?
You can install something like Sucuri plugin which will track if the core Wordpress files have been modified and to block PHP execution from locations where it has no business to be executed, like Uploads directory etc..BUt at the end of the day all of those attempts are fairly easy to detecxt cause you will inspect the website yourself, and will spot on any fishy behaviour like redirects, popups or you can use soemthing liek Sreaming Frog tool to check out your on-page SEO and detect all the links and markup on your website.
Best of luck, and try to use the common sense when you are choosing with whom you work with, real proffesionals will never downgrade themselves with some low costs packages, like 40$ for a website or some nonsense like that..
