As I explained, the notion of "the last thing during boot" is not well-defined with a partially ordered and parallel init system like systemd or upstart (or even sysvinit+startpar).
So as long as cloud-init.service declares itself to run after rc-local.service, then rc-local.service necessarily can't be "the" last thing even accidentally. This is something to decide in cloud-init.service.
As I explained, the notion of "the last thing during boot" is not well-defined with a partially ordered and parallel init system like systemd or upstart (or even sysvinit+startpar).
So as long as cloud-init.service declares itself to run after rc-local.service, then rc-local.service necessarily can't be "the" last thing even accidentally. This is something to decide in cloud-init.service.