I believe S T R A and P might be the friendly names for some of the internal qfuses used by samsung, and secureboot is a different internal qualcomm non-volatile register (but that one can be changed, unlike the qfuses).
My own EU N9005 is S1, T1, R1, A1, P1 and also SECUREBOOT: ENABLE (CSB).
The qfuses seem to matter in certain unlocking scenarios - there is a document somewhere that describes how reactivation lock can be removed by Samsung themselves and that involves writing specific firmware that is different depending on the above flags (with something like 3 major options if I remember correctly).
In the past (as recent as first generations of i9505 I believe) SECUREBOOT: ENABLE was only used when a locked bootloader (I believe mostly AT&T and VERIZON) was active. That has changed with Knox - a non-secured boot does not quite sound compatible with the way Knox is supposed to work - so I believe Samsung is now using most of the time SECUREBOOT: ENABLE and eventually enforcing some other/further restriction from inside the bootloader.
The presence of SECUREBOOT: NONE suggests a much, much wider degree of freedom, and possibly from this state it MIGHT be achievable to bring a device to a state very close to factory.
Unfortunately so far we only know that a knox 0x0 secureboot: ENABLE can go to knox 0x0 secureboot: NONE (but at this point it is very, very unclear how that was achieved - if anybody has more details please post those). It is NOT clear if a knox 0x1 secureboot: ENABLE can go to secureboot: NONE (from where I would assume that knox might be easier to reset, but I could be wrong).
I believe right now the bounty here is over 2500 USD to reset knox and over 1000 USD in a few other Note 3 forums (I believe there are at least 5 major Note 3 forums), plus a huge amount of fame and karma so we might get to see some very interesting things on that subject
