[HTC Wildfire S] no.human.being:
You have to differentiate between an unlocked bootloader and S-OFF.

Unlocked bootloader will allow you to flash unsigned images to all "visible" partitions (like "boot", "recovery", "system", "cache", "devlog", "userdata", "misc") via Fastboot, dump these partitions via Fastboot and it will allow you to load custom boot code into the device's RAM via Fastboot.

S-OFF will allow you to flash unsigned images to all "visible" partitions AND the device's high-security "unmapped memory area" or "Radio area", which is the part of the device memory that is not visible to Android. It's the part of the NAND where the SPLs like HBOOT, the Radio Realtime Executive, etc. are. However, it will not grant you Fastboot access, you will only be able to write to these partitions by providing an NBH to the bootloader on the MicroSD card.

Unlocked and S-OFF are not related. A phone can be neither unlocked nor S-OFF or it can only be unlocked but not S-OFF or it can only be S-OFF but not unlocked or, and this is probably the most interesting combination, it can be BOTH UNLOCKED AND S-OFF. This combination is very very nice because it will grant you Fastboot access to all memory areas, including the protected Radio areas.

How will you install a modified HBOOT by writing to "misc"? You can unlock an HBOOT without a matching unlock key because the information whether HBOOT has already seen a matching key or not is stored in "misc". However, an unlocked bootloader is not equivalent to S-OFF. An unlocked bootloader allows you to flash and boot unsigned recovery images and these recovery images can be used to install custom ROMs on the device. However, it will not allow you to flash unsigned Radio images, bootloaders, splashscreens, etc. Basically all that requires access to the "unmapped" or "Radio area" of the phone's NAND.Only S-OFF will allow you to do all that.

Because Revolutionary is doing it this way.

No it can't be. The SBL is Qualcomm (processsor manufacturer) software. All handsets using identical chipset use identical SBL. HBOOT is operating system specific, device-vendor dependant software. Only HTC handsets use HBOOT and as it's heavily based on Google's Android reference bootloader, it's only used on Android phones. Why should Qualcomm firmware (SBL) consider HTC firmware (HBOOT) trustworthy? Qualcomm has dozens of customers that use their chips in devices such diverse as network routers, tablets, phones, hard drives, etc. Against what should they verify the HBOOT code? Against an HTC certificate? Why should they consider a certificate of their one-of-many-customers trustworthy? Or do you think Qualcomm ships their certificates to their customers to sign their own code with them so that Qualcomm's SBL recognizes it as "genuine"? A bit unlikely, don't you think?

The PBL is shipped with the processor, stored in ROM and thus guaranteed to be "genuine". It boots first from an internal boot ROM (it's an actual ROM, it's not NAND). PBL then checks the signature of the DBL (which is stored in NAND), loads it into memory and executes it. DBL loads the SBL/OSBL from NAND, verifies its signature and executes it. The SBL is the bootloader of REX, aka Radio, which is basically a paravirtualized operating-system called Iguana ported to ARM. The SBL then loads REX into mARM and APSBL (HBOOT) into aARM. Execution begins on mARM, while aARM is kept captive by a watchdog process. After mARM has initialized successfully, it signals the watchdog and sets aARM free. This is the point where aARM executes its first instruction, which is the jump instruction with which the HBOOT image begins.

As you can see, only Qualcomm-internal (processor specific) components are verified. PBL is the root of trust. PBL verifies DBL, then executes it. DBL verifies SBL/OSBL, then executes it. SBL loads REX and APSBL (HBOOT) into their respective address spaces. This is where the chain of trust ends. No verification is performed at this stage, since APSBL is vendor-specific third-party (and therefore untrusted) code.

I think you have some misunderstanding of what the companies do. ARM provides the processor design and companies like Qualcomm manufacture the processors (the Qualcomm MSM7227 is an ARM1136EJS design by ARM Ltd.). The processors ship pre-programmed with a PBL and DBL, which is firmware by ARM Ltd btw. not by Qualcomm. Qualcomm and others just manufacture what ARM Ltd. develops. They do not design these ICs on their own. Then the processors get to PCB manufacturers that manufacture the boards including the processors and other components. Then companies like HTC buy these PCBs, together with some other hardware components, build a phone out of it, license system software from Google (Android with its bootloader and Radio firmware that Google licensed from the Australian NICTA), customize it a bit (turning the bootloader into "HBOOT" - well a vendor-specific name, but the code is essentially by Google), make the interface a bit uglier and more ressource-hungry and calling it "HTC Sense", put it all together and sell it as the "HTC Wildfire S".

Don't think that the hardware is HTC-specific. You will find the same components in other phones. The same LCDs, the same proessors, the same memory, probably in a slightly different combination. Don't think that the software is HTC-specific. You will find the same components in other phones. The same Radio, the same operating system, the same bootloader under a slightly different name and with slightly different graphics. It's all not unique. Rather it's all the same. And it's not the phone manufacturers developing these things. The smart brains that drive innovation are the engineers working at the companies that supply the components. The phone manufacturers basically just pull stuff together from various sources and integrate it into a package that they consider suitable for the end customer. You cannot expect them to actually develop any significant amount of this stuff on their own.

No we won't brick. You can install bootloaders using "fastboot flash hboot hboot.img" and as long as HBOOT itself (the HBOOT running on the device while you set that Fastboot command off) does not verify the image's signature before writing it to NAND (e. g. because the phone is S-OFF), it will successfully flash and of course your device will NOT brick (unless the boot code is faulty). If HBOOT verifies the signature it will not flash and of course the phone won't be bricked either.

Revolutionary explicitely states on their site that they didn't find any way to disable security in what they call "the NVRAM" and they then "turned their attention towards the HBOOT". There are people with Revolutionary S-OFFed devices that verified that the only things that are modified by Revolutionary are the HBOOT and boot splash image and the backup CID stored in the beginning of the "misc" partition.