I currently have two Galaxy S5 devices. The SM-G900T (T-Mobile), and SM-G900P (Sprint).
Both have unlocked bootloaders. That means I can flash TWRP and boot to its environment (with full root access) without modifying /boot or triggering a Knox warning on normal startup, and allowing a stock ROM to load that has been modified - all the while still passing security scans, SafetyNet checks, etc.
My goal with this is to have a complete, working stock installation, but with many things stripped out that aren't necessary.
Step 1)
Boot to Download mode, flash TWRP.
Step 2)
Boot to Recovery (TWRP).
Step 3)
Flash any modification package. Custom boot animation, debloat script, etc.
Downloads coming soon. Test scripts are in progress as of January 18th, 2019.