If I buy a Nintendo Switch game on a cartridge and updates are released (like Witcher 3 for example), will I still get them or am I stuck with whatever version came on the cartridge?
Yes, they do.
Whether the game is digital or phyisical, when the Nintendo Switch console is connected online, if a software update is available you will be prompted to download it upon starting the game.
In the game menu (pressing + button) you always have the "Software Update" option available to check for the latest update, both digital and physical copy allow you to do that.
Digital one is entirely installed on your console, but physical will have to copy some files too. For example, it's common that a newly released game will receive a "day-one patch" (usually because some bugs were fixed between the game being version-locked for pressing discs and actual release day).
A physical game with no updates will be unfavorable (or useless) otherwise.
When playing a game on Switch with a internet connection, the console always tries to update it to the latest version. There is no difference in where the initial files to install it came from, a cartridge or some online server.
When installing from an online source, you get an installer that already includes most updates and only need to install the latest ones in addition. When installing from a cartridge, you need to download all updates that were made since buy time, which may mean a bigger download of updates (but no installation download). However, the whole download and used disk space is always smaller with a cartridge as you already got some files on there.
When the game is up-to-date, there is one difference left: When using a cartridge, you need the cartridge inserted to play.
The Nintendo Switch itself does not require internet to be used, so if you play a game with a cardridge, it won't get updates and you gotta play the "old" version. Also, without internet, you cannot install from online sources.
As Dreamer stated in the comments, and here described, the cardridge itself does NOT install anything. It only stores updated and added files in the switch, which leads to a lower need of disk space. Because of that, when using a cartridge, there's also no need to wait and you can instantly play the game without installation.
Not only you can update cartridge games, but quite often you must do so, or the game won't run on an updated console. For example a Bomberman R which ran without updates on Switch system version 2 would refuse to run on the current vesion (13.0.0) without an update.
This (mandatory cartrige updates) is exactly why it's recommended to install eShop games on the SD card and keep the internal storage free for updates / DLC of physical games. If you install updates for a physical game on the SD card, you will need both the SD card and the cartridge to play it, and if you upgrade or re-format the SD card, you'll have to re-download updates for some physical games before you can play them at all.