We've had this discussion before. Recovery needs to be at the end now, per MS official stance, so that it can be expanded when Recovery is too small to fit new WinRE bloatage. WinRE is super important because there are so many BitLocker or security issues, it will always be high on MS's patching priorities.
The CU will attempt to shrink your system partition to carve more space for Recovery. But you can't grow Recovery if it's trapped in the middle, since that requires Windows ship a real repartition/data migration tool since shrinking is an easy exercise for the OS.
If you know the disk's size in advance, you can hardcode the Recovery at a fixed location at the end.
If you don't know the disk's size, then Extend is the only tool you have. Non-automated WinPE Setup cheats since it's implicitly doing a "shrink volume" on your behalf without informing you. <DiskConfiguration> can't do this, so you must resort to RunSynchronous commands.
You're correct that my script wipes out any NTLite-provided disk layout. That's because NTLite can't do this unless you resort to adding WinPE RunSynchronous commands, and I know your stance on supporting Run commands. The script exists so an educated user can convert any existing autounattend.xml (made by NTLite or not), and just replace the system partitioning.