For a one-time pad to be truly secure, do I need to use XOR? In other words, is a numerical OTP as secure as a XORed one?
I'm new to cryptography, so this might not even make sense.
You do not need to use XOR as the combining operation. You can use modular addition as the encryption function and modular subtraction as the decryption function and it will remain information theoretically secure.
XOR is typically used because it is convenient -- it is its own inverse (an "involution"), and it is smaller/simpler to implement in hardware than adders and multipliers.