From what I can tell, themes do not process update hooks since they do not have a schema value tracked in the key_value table. So a hook_update_N is not possible in this case.
This means that you have a couple of options.
Option 1
If the theme is going to be updated in code, but not updated right away through the UI form, you will probably want run a drush command as part of the theme update.
drush config-set THEME.settings NEW_SETTING NEW_SETTING_VALUE'
Reference: https://drushcommands.com/drush-8x/config/config-set/
This will allow you to set it once and then any future updates/overrides can be handled as usual through the configuration system.
Option 2
If you are talking about a theme that is part of a distribution, and you don't have access to the system to run the drush command, then you could set a default value on the hook_form_system_theme_settings_alter function. This would not provide the value to the system when it loads the config, but it would provide a default to users when they update the theme and save the settings form.
If you did it that way, you would need to provide a fallback in your theme for if/when that value is not present to prevent unexpected behavior if the new setting value isn't yet set in the site's settings file.
Option 3
If you have access to the codebases for the affected systems, like in a site factory, then you could technically provide the new value in the exported configuration file itself and then it would be picked up upon config import.
