The package sources are standard, as set up by the Odroid Petitboot install of Debian 11 via network. It seems you are absolutely right in your assumption: Debian has released a bullseye security backport kernel version newer than the one provided from ppa.linuxfactory.or.kr, so I had to increase the repo priority...

Kernel package used before the latest update:
# dpkg -l linux-image-5.16.0-odroid-arm64 
Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten
| Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/
         Halb installiert/Trigger erWartet/Trigger anhängig
|/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht)
||/ Name                            Version                       Architektur  Beschreibung
+++-===============================-=============================-============-====================================
ii  linux-image-5.16.0-odroid-arm64 5.16.16-202204242219~bullseye arm64        Linux 5.16 for 64-bit ARMv8 machines
# apt-cache policy linux-image-5.16.0-odroid-arm64 
linux-image-5.16.0-odroid-arm64:
  Installiert:           5.16.16-202204242219~bullseye
  Installationskandidat: 5.16.16-202204242219~bullseye
  Versionstabelle:
 *** 5.16.16-202204242219~bullseye 500
        500 http://ppa.linuxfactory.or.kr bullseye/main arm64 Packages
        100 /var/lib/dpkg/status

Kernel package installed with latest apt update:
# dpkg -l linux-image-5.18.0-0.bpo.1-arm64
Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten
| Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/
         Halb installiert/Trigger erWartet/Trigger anhängig
|/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht)
||/ Name                             Version          Architektur  Beschreibung
+++-================================-================-============-=============================================
ii  linux-image-5.18.0-0.bpo.1-arm64 5.18.2-1~bpo11+1 arm64        Linux 5.18 for 64-bit ARMv8 machines (signed)
# apt-cache policy linux-image-5.18.0-0.bpo.1-arm64
linux-image-5.18.0-0.bpo.1-arm64:
  Installiert:           5.18.2-1~bpo11+1
  Installationskandidat: 5.18.2-1~bpo11+1
  Versionstabelle:
 *** 5.18.2-1~bpo11+1 500
        100 http://httpredir.debian.org/debian bullseye-backports/main arm64 Packages
        100 /var/lib/dpkg/status

After increasing the priority for ppa.linuxfactory.or.kr to 900 the issue is resolved:
# apt-cache policy linux-image-arm64
linux-image-arm64:
  Installiert:           5.16.16-202204242219~bullseye
  Installationskandidat: 5.16.16-202204242219~bullseye
  Versionstabelle:
     5.18.2-1~bpo11+1 500
        100 http://httpredir.debian.org/debian bullseye-backports/main arm64 Packages
 *** 5.16.16-202204242219~bullseye 900
        900 http://ppa.linuxfactory.or.kr bullseye/main arm64 Packages
        100 /var/lib/dpkg/status
     5.10.120-1 500
        500 http://security.debian.org/debian-security bullseye-security/main arm64 Packages
     5.10.106-1 500
        500 http://ftp-stud.hs-esslingen.de/debian bullseye/main arm64 Packages

That should probably be set as default in the Odroid images/packages:
# cat /etc/apt/preferences.d/ppa_linuxfactory_or_kr.pref
Package: *
Pin: origin ppa.linuxfactory.or.kr
Pin-Priority: 900

Thank you for your swift support, it's very much appreciated!