In which order should be Drupal updates and configuration import/export run?

The answer is... generally run updates first. Whether to import or export the configuration afterwards depends on who updated the contrib code base.

You are updating the contrib code base

If you are updating the contrib code base, run the database updates and then export the configuration, as updates tend to alter the configuration storage data which needs to be commited into the version control system:

• Pull changes from the repository
• drush cim to import your colleagues' configuration changes
• composer update to update the contrib code base
• drush updb to update the Drupal database
• drush cex to export potential configuration changes after the update
• Commit changes into the repository

tl;dr

git pull \
&& drush cim -y \
&& composer update \
&& drush updb -y \
&& drush cex -y \
&& git commit

Someone else updated the contrib code base

If you are on the receiving end of an update (someone else updated the contrib code base), or you are in fact a deployment script and not a developer, run the database updates and then import the configuration:

• Pull changes from the repository
• composer install to synchronize your contrib code base with the remote
• drush updb to update the Drupal database
• drush cim to import your colleagues' configuration changes

tl;dr

git pull \
&& composer install \
&& drush updb -y \
&& drush cim -y

Alternatively use the new drush deploy command

The need to standardize Drupal deployment has led to the following command:

drush deploy

This does roughly the same, but the docs state that if more control over the deployment process is needed, the atomic commands need to be used like in the example above.