OK, after trying several scenarios with the 2019-001 security update, here's what works for me.
High Sierra security updates also update the Recovery HD, unlike Sierra and earlier. That recovery update process is buggy and often fails, but there's a workaround.
If you want the Recovery update:
Download and expand the security update package as in post 1. Then copy four files (AppleDiagnostics.chunklist, AppleDiagnostics.dmg, BaseSystem.chunklist, BaseSystem.dmg) from RecoveryHDMeta.dmg in EmbeddedOSFirmware.pkg in the update package, to the root of a dosdude 10.13.6 installer (replacing what's there), then boot and run the dosdude installer as usual. That resets the system to pure 10.13.6, but the Recovery HD will be the latest. (Remember that Mac OS installs do not affect installed applications or user data.) Once that's done, install the editted security update as in post 1, or simply use "softwareupdate -i -a" to install direct from Apple. Once all that's done, both your system and recovery will be up-to-date.
If you don't want the Recovery update:
Download and expand the security update package as in post 1. In addition to the edits in post 1, locate the RecoveryHDUpdate.pkg/Scripts/ directory and edit the replaceRecovery file. Edit the two lines starting "/usr/bin/hdiutil" to start "echo /usr/bin/hdiutil". Edit the two lines starting "./Tools/dm" to start "echo ./Tools/dm". (In all cases you simply add "echo " to the beginning.) Then flatten and install the update package as described in post 1. This updates your system but leaves the recovery unaffected.
(In my case I don't even have a Recovery partition. Who needs one when you have an installer stick? The second option suits me fine.)
I hope these workarounds work for other people. Please let us know if they do not.
[doublepost=1548207165][/doublepost]
Among my many, MANY jobs over the past few decades, I've been a software release manager. I know how they think.