There are newer versions of NTP in the support repo that address the latest CVEs against NTP. Which publisher are you pointing to? `pkg publisher` You'll also want to show `pkg info entire`
You could try to update the pkg: `pkg update -n ntp` (where the -n is doing a dry run)
If any updates are found/available, it will tell you want it would take to install the update if you issued the commaned with out a -n. And then a bounce of NTP to pick up the new binary. Only you or your mgt. can say whether that bounce is an impact.
And ideally update to 11.3 to keep all the other packages up to date as well.
p.s. Nice system.