How should a DMZ be placed in a highly secure network architecture?
The key is defense in depth between security domains. The extent of the deployed architecture will be dependant on the resources available, including financial limitations and technical capabilities.
Defense in depth
Defense in depth is an information assurance (IA) concept in which
multiple layers of security controls (defense) are placed throughout
an information technology (IT) system. It is a layering tactic, to
mitigate the consequence of a single security control failing. Wikipedia
A security domain is the determining factor in the classification of an enclave of servers/computers. A network with a different security domain is kept separate from other networks.
For the purposes of determining controls between security domains you could define; the internet as untrusted, the DMZ as semi-trusted, and internal networks as trusted.
Therefore, you would employ multiple layers of security controls between the internet and your DMZ, which could include: L3 firewalls, IPS, AV, Reverse-proxy/Load-balancing, L7 filtering.
From the DMZ host(s) back to your internal network, you would employ additional layers of: L3 firewalls, L7 filtering (e.g. RPC), IPS/AV.
Least privilege access between security domains is also key to maximise the effectiveness of the security controls.
Is the first representation OK from a security point of view?
I would advise no, due to a lack of defence in depth. There is only a single access control between the Internet-DMZ, and DMZ-LAN. Typically a highly secure architecture would have vendor-separation, and layers of access controls (L3 FW, WAF, IPS, AV, etc).