Three factors come to mind from my reading over the years: Heat Shield integrity, Escape Tower limitations, and avoiding fuel over the CM on the pad. Keep in mind the stacking is Escape Tower (ET), Command Module (CM), Service Module (SM), Lunar Module Shroud , Lunar Module (LM).
The ET, in order to keep its own mass minimal, only lifts the CM and itself. When it is triggered, the CM/SM joins are broken, and the ET's rockets fire.
The CM/SM connections all routed around the heat shield on the CM, none of them go through it. NASA has stated in several documents that this was to preserve the heat shield integrity.
The CM and SM do need to be connected - the capsule is only good for a few hours comfortable operation without the SM's support systems, and NASA's safety culture precluded any in-flight connections being made that were not mission essential. (A failure to dock to the LM would not be a mission failure, per se. It would abort the landing, but the LM was essentially just pushed along with the CM/SM)
The shroud serves several purposes - one of which is transferring the load of the ET/CM/SM stack down to the S-IVB. The shroud also prevents damage to the LM before and during launch, and keeps the LM separated from the SM, as well as streamlining the stack, and preventing animals being accidentally carried. Note that the LM is not actually connected to the SM while inside the shroud - the CM/SM stack separates from the shroud, which then itself opens, revealing the LM.
The LM itself is a dual stage design - the Lunar Descent Module, and the Lunar Ascent Module.
NASA did consider some alternate stacking schemes, but these were not for the Apollo CM/SM/LM as launched - these final designs were concept approved well before production designs were completed. Two of the three other stackings considered (see link 1) are worth discussion.
One alternate stack was a CM/SM/LunarLaunch/LunarLanding stack - no on-orbit docking maneuvers. It would have, however, required a larger launcher than the Saturn V, and would have had the potential for losing all three astronauts at once at the moon, and would not have had the orbiting CM for comm relay and visual confirmation. The costs of designing an even larger launcher were considered prohibitive.
The second alternate stack given serious consideration was to launch the LM separately on a second Saturn V. This would have allowed a considerably more powerful LEM and a larger CM as well. It was not, however, considered cost effective, and so was rejected.
Discussion and Elaboration
The CM design could not have had the LM above it - it would have made the escape tower too massive, and the Apollo project was run almost to the safety limit already. Further, that would have put several tons of high explosive fuel above the CM at load, which would have been rejected even by the (now relatively lax) safety standards of 1960's NASA.
The SM cannot be stacked above the CM for the same reasons, plus even more mass.
That the capsule need not be 2-axis balanced was apparently not considered until later in the program, in the 1970's.
The SM has to be able to use its engines; they're used for mid-course corrections, lunar orbit insertion and trans-Earth injection. Therefore, the LM cannot remain stacked underneath the SM if the SM is to have a single engine. The single engine is a matter of simplicity.
The LM cannot be used as the TLI/LOI engine, either - it would require more structural mass, and the LM engine is left of the surface.
The LM in the middle requires disconnecting and reconnecting the CM/SM, or having the CM be self-sufficient aside from the rocket motor, or having the connections run around the LM; for a variety of reasons, this was not practical.
So, for reasons of simplicity, the historic stacking mode was the best combination of habitability, safety, and price for the available technology set.