So I picked up a gently used G950U1 on Swappa at a good price, and of course it had Pie on it. Last update it looks like -- G950U1UEU8DUG4.
Yes I'm a glutton for a "dare to try it", and it worked. Here's the exact process I used for a Nougat-based root:
1. Download and unzip files.
2. Open modded "Odin3_v3.14.1_3B_PatcheD" (to flash Combo firmware).
3. Boot phone to Download mode (press & hold Bixby + VolDown + Power) & plug it in (Windows 7 Pro 64-bit laptop here).
4. !!_UNCHECK_!! Auto Reboot in Odin.
5. flash Combo firmware in AP slot.
6. Reboot phone to Download mode.
7. Reflash combo firmware, let phone auto-reboot.
8. Connect phone and run "S8-SafeStrap.bat" file in the unzipped "Safestrap_S8_Series" folder.
9. Phone will reboot twice if successful. When done, Safestrap will be installed
10. Copy "system_s8_nougat.img" to phone (from the unzipped "G950U_NOUGAT_V8"). For Nougat also copy Magisk_System-v21_4.zip (downloaded from link in OP) to phone.
11. Reboot, choose Safestrap recovery. Flash nougat_s8_system.img and then Magisk.
12. Reboot to download mode & in the modded Odin AP slot, flash "BL_G950U_NOUGAT_FINGERPRINT_FIX.tar.md5".
13. Let phone reboot to Android (at the Safestrap prompt select "Continue").
I now have -Rooted- Nougat 7.0 running on this S8, build number G950USQS2BRB1. The "service provider SW ver" shows as VZW/VZW/XAA. Firmware is clean and lean, no bloat to speak of.