That’s correct, @pwhodges. The rewrite middleware is called relatively early on in the chain and it picks the first valid (i.e. passes if and regex checks) rewrite rule with the longest base path to execute before passing on to the next middleware.
So strictly speaking, if {uri} not_starts_with /l/ is unnecessary in the above example, but included for readability; since only one rewrite would run, it will either be the first when its conditions are met, or the second otherwise.