[AT&T, Rogers, Bell, Telus Samsung Galaxy S III] dawgdoc:
There is a lot to cover to address all that you bring up.

Regarding EFS, there are a number of ways to back it up. Use several. This thread is an excellent place to start for more info and several ways to make the backup. I was rooted, so I used A2 and B. I believe you can use A1 without being rooted, probably B as well. Long after that post was written wanam came out with two backup apps available in the PlayStore. One was specifically for EFS, but I do not think it is still supported. The other is a more comprehensive app, both require root.

As a rule, bootloaders and modems are not installed with custom ROMs. If you are flashing a stock ROM from these forums that is installed from within a custom recovery it probably does not install a bootloader and modem either, but read the relevant thread to be certain. Full stock ROMs flashed from with Odin, or Heimdall, almost certainly install a bootloader and modem.

Prior to 4.3 there was an ability to downgrade bootloaders and modems, nor were they required to match - be at the same version. Once you upgrade to the official 4.3 bootloader you can no longer downgrade it. Once you have upgraded to 4.4.x the bootloader and modem versions must always match. If they are mismatched you risk soft bricking your phone at a minimum. For the i747 there was an unofficial 4.3 release; ROM, bootloader, and modem. I do not recall seeing mention of an unofficial release for the i747M, so I will not go into the exceptions on the above the unofficial bootloader/modem introduced.

For TouchWiz ROMs, custom or stock, the bootloader (and modem) version should match or be more current than the ROM Android version. (One of the unofficial 4.3 release exceptions applies here, I make use of it.)

For CyanogenMod, CM based ROMs, AOSP ROMs, and their derivatives the bootloader and modem version can lag behind Android version of the ROM. With your 4.1.2 bootloader and modem you could run the earlier releases of 4.4.x CM and AOSP ROMs. Later in the 4.4.x development, around Oct or Nov 2014 IIRC, I began reading reports of needing to be on 4.3 or later, there were a few said the 4.1.2 firmware still worked for them. For the 5.x.x LP releases of CM and AOSP most report that they must be on a 4.4.x bootloader and modem.

Knox is in the ROM, not the bootloader and modem. It was introduced with the official 4.3 releases. It is not present in CM/AOSP nor most of the custom TW ROMs. It will be present in stock ROMs from official sources or sites like sammobile. Many of the stock ROM images/dumps have Knox disabled, especially those from enewman17, but read to make sure what you are getting.

I don't feel qualified to discuss tripping the Knox counter, I am still on the unofficial 4.3 bootloader, which has not kept me from running 4.4.x ROMs. I am not the only Luddite, but I feel we will all be updating bootloaders and modems due to the Stage Fright bug. I am long out of warranty so there is no loss.

ABOVE ALL, read thoroughly before taking any action. Keep in mind that I am on the i747 and not the i747M as you are, I am not be correct on all comments for your device. [MENTION=4673498]audit13[/MENTION] should be able to clear any gaffs I have made.