I guess a few people will wonder the same question...so...
S_OFF is another way of saying "security off"...which means that nand is unlocked and so is the bootloader.
This basically means that you can mod the system while booted. S_ON means security on...nand is locked and so is bootloader.
Therefore your phone’s security level can be set to S-OFF, thus bypassing a standard security feature which checks the signatures of firmware images before flashing them.
I
*think* with nand unlocked we can apply metamorph themes, but that I am not 100% sure of myself....I sure hope so though!!
Security is actually a flag set in Radio NVRAM.
HBOOT acts according to this flag being set to on or off. That means, locking NAND, checking signatures. Then there's engineering bootloaders.
ENG bootloaders ignore the security flag, and act like the phone is S-OFF, thereby disabling the nand lock and signature checks. As an added feature, it also allows for flashing images directly using fastboot, e.g.: fastboot flash boot boot.img. It also offers a feature (for developers) to test kernels, by doing 'fastboot boot boot.img' which does not actually write anything, but just boots the downloaded kernel image.
The HBOOT we will release will be very (if not 100%) close to ENG bootloaders.
It ignores the security flag in radio NVRAM (we can't set this, yet), and it allows for the extended fastboot features listed above.
This does mean, that if an OTA overwrites the installed patched HBOOT, the security-ignore and extended fastboot features are lost.
This differs from Radio S-OFF, whereas this would survive any OTA/RUU.
The intended effect however, is the same.