I would not flash a custom recovery if you are on 4.3. I am pretty sure 4.3 bootloader will trip knox. You need to be on the 4.4 bootloader in order to install CWM or TWRP without tripping. I know this because early on when the note 3 first came out, people were using cf-autoroot and it was tripping knox. Then the 4.4 bootloader came out and the reports started to roll in of keeping 0x0 all the way through.
Wow I think you got the "difference". Kudos!
From 4.3 if you dare flash anything (im not including root de la vega or Kingo) : You WILL trip knox.
At that moment I didn't want to trip so I only rooted with Kingo. Knox 0x0.
Again if you'd like to just try to repeat what I have done: ** Warning. I'm a noob and I DO NOT know so much about all this... Make sure you know what you're doing because you can get 0x1 know trip and bootloops trying this. **
From my 4.3-Kingo-rooted W8 ...
1) I have updated OTA to kitkat VLUCNB7 (no matter where you start from or how you do it, after that OTA, you get Stock and without root on 4.4.2)
2) Flashed CF-Auto-Root-hlte-hltexx-smn9005.tar with Odin 3.09
3) Flashed CivZ-SnapKat-Rev2.2-sm_n900T-4.4.2 with Odin 3.09
4) Booted and used the phone for a few minutes
5) Flashed TWRP (hltecan-recovery.img.tar) with Odin 3.09
From that point I took a complete backup (update.zip) with TWRP and tried a few roms (and failed trying them, all bootloops)
Even after that, I am Knox 0x0. I think 4.4.2 may be that difference in not getting tripped.
Good luck folks
I hope my feedback can help you out