If your goal is to always stop/disable a specific package (i.e. you will never ever run it), there's no real harm in this script running post-firstboot.... it will evaluate the if statement (which will be false once the package is disabled the first time), and exit out.
@hnyman - If this was in a script and that was called by rc.local, wouldn't this work by nature as long as both rc.local and the other script were included in the standard backup files? Wouldn't this also work with ASU? I'm trying to figure out if I'm missing something (i.e. why it needs to be baked in vs part of the standard backup set).
I'm not real clear as to what you want to keep around across upgrades, but you can see what sysupgrade will retain with its --list-backup option:
$ sysupgrade -l
... a bunch of files to keep ...
And you can extend that list by putting file or directory names in /etc/sysupgrade.conf. For example, I'll often do echo /root/test.sh >> /etc/sysupgrade.conf when I want to run a sysupgrade and keep some experiment around.