Drupal 8 releases have been programmatically marked as unsupported, in the same way it was done for Drupal 6 releases time ago. They are marked as unsupported because, once a Drupal branch is unsupported, no security issue will be handled by the Drupal.org Security Team, for that Drupal branch and any module compatible with that Drupal release.
What reported as Requires Drupal: ^8 || ^9 isn't the required Drupal versions but, more exactly, the Drupal versions with which the module is compatible. A release that is compatible with Drupal 8 and Drupal 9 is usually necessary to migrate a site to Drupal 9.
That doesn't mean a module that is compatible with Drupal 8 is always safe to be installed on Drupal 8; it could contains a security issue when the module runs on Drupal 8 that nobody discovered. In the case a security issue is reported, it's up to the project maintainers fix it for Drupal 8.
Notice also that, when a release isn't covered by the security advisory policy, security issues could still be reported. What changes is how those security issues are reported: For releases covered by the security advisory policy, users are required not to report them publicly, but report them to the Drupal Security Team, privately; that isn't required for releases not covered by the security advisory policy, which include the alpha, beta, and release candidate releases.
The 9.1.0-alpha1 release shown in the screenshot isn't covered by the security advisory policy, which means that release is secure to be used on Drupal 8 in the same way it's secure to be used on Drupal 9.
