Patching strategy when Windows and SQL Server patches not applied for over 3 years
IMHO I'd recommend breaking up the updates into major SPs and OS vs SQL. That way if anything breaks you can rollback more easily and pinpoint issues. For example, roll out Server 2012 SP1 let it mature for a week or two, then do a SQL SP wait a week or two, etc... 

Your methodology sounds good for patching the secondary node, failover, patch primary node, and then balance the cluster.