On the issue where applying CU breaks the secondary OWA and ECP, to resolve,
1) Perform the copy process again. If you stop here, you can access the ECP page but when you tries to login, it may tell you that the authentication failed.
2) Use Set-OwaVirtualDirectory and Set-EcpVirtualDirectory to set the FormsAuthentication or WindowsAuthentication for both OWA and ECP with the original values you have set previously. You can view the original settingd using Get-OwaVirtualDirectory and Get-EcpVirtualDirectory.
3) Run IISRESET and the secondary OWA and ECP should be working again.
I have done this across several CUs (latest CU 8) and it works fine.
Note: After logging in to the ECP for the first time, sometimes it would show an error page. To resolve, just enter the ECP URL again (example, https://mysecondary/ECP) and the page should load properly.