Criminality usually comes first, but it's possible indeed that they start eligibility while it's still in progress. With this new biometrics requirements, it seems they have expanded their range of checks. But it really depends on the visa office, and it's indeed something you can see frequently for applications process at CIO Sydney NS. They start eligibility soon after starting criminality.
But security, I do believe they leave it for last usually, until all previous stages are passed.
Thing is, statuses can be confusing even on their end. Statuses can sometimes change from Passed, to In Progress, to Not Started, as it moves from VO to VO.
I usually encourage others to just sit back and relax, and grab some popcorn while they process your application. If you try and understand too much their inner works, you'll have grey hair by the time you get PPR.
