In order for automatic upgrade to work, two things must be true:
1) The version number of the bug-fixed package must be incremented. We can use the dot release number for this. Suppose package foo is on version 3.0 and it gets a bug fix. It should now be 3.0.1.
2) The version must be tagged as compatible with the kernel. Since .LRN 2.0 runs on OpenACS kernel 5.0, this means that the version must be tagged with openac-5-0-compat. This gets a bit confusing when the bug fix is on the version of the package that's on the 5.1 branch. It's still just a matter of tagging, but you have to be sure that the 5.1 code is still compatible with 5.0, and that the upgrade works.
If the developer does all that, then in order to get the fix, admins only need to go to the APM and click Upgrade From Repository and pick that package. If you are running from a local cvs repository, it's a bit more complicated but it's all documented, as noted above.