[Google Pixel 2 XL Questions & Answers] simplepinoi177:
So, about booting TWRP...

You can temporarily boot into TWRP just the one time if you wish. If you are using the newest version of TWRP (for the Pixel 2), they actually give an option to flash and replace the recovery with TWRP from within their recovery environment; I'm guessing they use the temporarily booted twrp.img to install. In any case, you can find the option in the Install section. In any case, it's up to you whether you install it as your custom recovery, but it's easy enough to restore it back to stock recovery either by manually flashing the stock boot.img (and maybe dtbo.img for good measure, as I'm unsure...) and/or if you update your device via a Full Factory (or even a downloaded OTA) image, as that will update and replace the boot partition regardless...

So, about the alert for enabling modification to the system; In the past, I had always enabled it. Of course you would want to have r/w and mounting capabilities towards the device's system and data partitions. But keep this in mind...until the TWRP team updates the latest version, there is no write capabilities/permissions. It will pull up an error that it either can't mount or doesn't write -- For this reason, I'm holding off so I don't have firsthand experience... -- but installing and flashing and backing up from within TWRP does work even if it spits up some errors. What you should be careful about is if/when it asks to install it as a "system service" or something, as general consensus says at no circumstance should you do this as it "forks" up many other things while at it.

But, to answer your question directly, I'm unsure whether you can or cannot install Magisk root or restoring without enabling this "modification" capability, but I say it can't hurt.....

As for your inquiries on OTAs, as I understand it (so anyone please correct me if I'm wrong), but the monthly security updates come with the OTAs (also monthly, so I believe they may be one in the same). I'm unsure about the whole seeing the security updates on the Play Store or something like that, but I highly doubt that is the case. Conventional knowledge says that you can only get these either from the stock System Updater or if you download them yourself and either sideload or "flash-all" it. That's why many (most) experts will download the Full Factory image every month (usually first Monday of the month) and we have this whole step-by-step process in updating platform-tools, unregistering Magisk modules and screenlocks/fingerprints, running the flash-all, temporarily booting TWRP, installing all custom modifications (Magisk last), rebooting after each and every flash/install, then going back into the OS and resetting up the screenlock/fingerprints and Magisk modules. As it would be nice if we could simply and always use the stock System Updater, but in any case, one would need to re-install all the custom modifications anyways. So, it is one of the sacrifices/compromises having a rooted Pixel 2….

But it is peculiar that you haven’t gotten any alert (unless you inadvertently updated to the latest already), for it still should alert you that there is an update available, and usually, if you have unlocked your bootloader, while it’s downloading and attempting to install, it will throw up an error; but everything would look like normal up to that point. But, then again, Google notifying updates on their various devices are intermittent at best. It would be simpler and best if you just keep it in mind that there’s usually the monthly update on/after the first Monday of the month and do what we all do and have to manually install the updates to keep most up to date.

If there’s anything else, you know you can ask…

Good luck and hope this helps…!