custom android on s-on phone

There were some earlier HTCs where flashing boot separately from ROM was needed if you were S-On, but I don't believe that was the case for the M8. Certainly with the M7 it made no difference to ROM flashing whether you were S-On or S-Off.

Always take a backup from TWRP before attempting the flash anything, of course.

S off is good for when you get into trouble. @Hadron is here with you so you're in good hands.

Yeah, S-Off gives you more options, including as James says the ability to use a wider range of RUUs, or to update the lower-level firmware without using an official RUU (which will replace your ROM and recovery as well, and wipe the phone). It also let's you remove the flag that says you unlocked the bootloader (not that I've ever bothered, and not important out of warranty) and makes modifying /system when Android is running easy. But it's not needed for flashing ROMs or updating recovery, so many people do those things without it.

What's going on is that the M8 is 3.5 years old, and HTC are no longer providing updates for it. To be honest I'd not be paranoid about security updates: most are patching vulnerabilities that aren't exploited in the wild, or which you are unlikely to encounter as long as you apply common sense in where you install apps from and what apps you install. I'm using a 4.5 year old phone and don't feel under constant threat as a result.

Apple make a point of supporting devices for longer, but they also have very few different models to support and you only get security updates if you run the latest OS (which can cause performance degradation on older devices in my experience). Also it's not necessarily possible for an Android manufacturer to keep old devices on the latest OS even if they wanted to: if say Qualcomm decide not to update binary drivers for an older chip to support Android 7, what do you do? Apple engineer their own chips so don't face that particular problem.

I'm not up to date with M8 ROMs as I don't have an M8 (and my M7 will be replaced once someone releases something that fits enough of my requirements, so I'm not watching development on that any more either). ROMs are device-specific, so it is a case of what's available for a particular phone. For the M8 there will be 2 types: those based on a modification of the HTC ROM (so based on HTC's user interface) and those based on Android without the HTC stuff. The latter are probably being updated more actively now that htc are no longer updating the M8 (with no new base there's less opportunity to update a Sense rom). You could look at a big multi-device rom like Lineage (successor to CyanogenMod), but I can't make any recommendations for the M8 from experience.

Have you tried the lineage os 15?