Yep that is a Tualatin, I did think about changing it but decided to leave it as is because I couldn't think of anything to replace it with.
Yes my understanding is DISM can work either on a running Windows installation or an offline wim file so it must be designed to work with whatever protections in Windows.
Of course if we were doing something similar with NT4 it would be more likely something like nLite where it applies to the NT sources instead of a running installation.
I haven't seen a batch updater for NT4 (or looked), I once wondered about if an unofficial service pack 7 for NT4 was feasible but after looking at some of the other unofficial service packs decided it was way too much effort for little gain. Also what tends to happen is the things I want eg the Active directory client someone else might not want at all. Also you tend to get into the position of do you just do OS updates or do you update IE6 as well? Some people want the shell update and some people prefer the standard shell.
DISM can already apply an msu patch to a Windows 7 WIM file and I imagine something like NTlite can probably handle most of the tweaks people want. (While I haven't had to use NTlite I assume it provides a fairly similar feature set as nLite and vLite.) I guess I'm far more interested in making NT4 (and maybe 9x) installs automated for when I want them whereas I feel the official deployment tools work well enough for providing me unattended and patched installs.