From what I can tell, themes do not process update hooks since they do not have a schema value tracked in the
key_value table. So a
hook_update_N is not possible in this case.
This means that you have a couple of options.
If the theme is going to be updated in code, but not updated right away through the UI form, you will probably want run a drush command as part of the theme update.
drush config-set THEME.settings NEW_SETTING NEW_SETTING_VALUE'
This will allow you to set it once and then any future updates/overrides can be handled as usual through the configuration system.
If you are talking about a theme that is part of a distribution, and you don't have access to the system to run the drush command, then you could set a default value on the
hook_form_system_theme_settings_alter function. This would not provide the value to the system when it loads the config, but it would provide a default to users when they update the theme and save the settings form.
If you did it that way, you would need to provide a fallback in your theme for if/when that value is not present to prevent unexpected behavior if the new setting value isn't yet set in the site's settings file.
If you have access to the codebases for the affected systems, like in a site factory, then you could technically provide the new value in the exported configuration file itself and then it would be picked up upon config import.