> I've been trying to work out if the current expl3 has anything like
 > \patchcmd from etoolbox.  

the current expl3 doesn't have something comparible to \patchcmd, not on that
level of complexity / generality

 > Will suggested looking at the various \tlp_
 > ... macros.  However, even a simple two-part test in this way fails:
 > \documentclass{article}
 > \usepackage{expl3}
 > \CodeStart
 > \cs_if_really_exist:cT{thanks}{
 >   \tlp_if_in:NnT\thanks{\footnotemark}{
 >     % Do something
 >   }
 >   \tlp_if_in:NnT\thanks{\footnotetext}{
 >     % Also do something
 >   }
 > }
 > \CodeStop
 > \begin{document}
 > \end{document}
 > I guess I'm abusing the functions.  So have I missed something obvious?

well, one thing obvious is \thanks is not a "tlp" variable is it?

more seriously, it is a function expecting one argument and therefore the
\tlp_if_in:NnT dies a horrible death because when trying to look into \thanks
it gobbles away the stuff it is looking for as it is not expecting that the
"tlp" sports arguments ...

so ...

a more general function would be

\def:Npn \cs_if_in:NnT #1#2 
  {\def_long:Npn \tmp:w ##1#2##2\q_stop {\quark_if_no_value:nF {##2}}
   \exp_after:NN \tmp:w #1 \q_nil \q_nil \q_nil \q_nil \q_nil \q_nil \q_nil
                           \q_nil \q_nil  #2 \q_no_value \q_stop }

stick that in your example and it doesn't die any longer (\q_nil can be
anything it is just there to be picked up as arguments if necessary (thus the
9 incarnations) ... and it is therefore the only thing that can't be searched

but you will notice that \footnotemark is found but \footnotetext is not. The
reason being that the latter is hidden within a brace group inside the
replacement text of \thanks. So perhaps not good enough to be useable for a
patching task

The \patchcmd does detokenization (loosing catcodes) and then rebuilds the
code using "current" catcodes, so it is kind of dangerous in situations

 >  The ability to patch existing functions is very handy.

probably is.