speedy, do you mean using Java8 with Spark or when Openfire is using Java8? This thread and ticket is related to Openfire only.
Last time i've checked (like a month or two ago) Java8 still had experimental status. And now they are EOLing java7 in a few months Probably java8 will become stable in that same moment.. I'm fine with java8 (been using it for 4 months with Openfire 3.9.3 with no problems) and especially when you can easily remove bundled java and use system one i see no problem neither in bundling java7 or updating to java8. This means, that Openfire should still WORK with java7, as i bet many users still have to use java7 for some reason (on Linux Oracle packages are pain and i feel OpenJDK not always works fine..).
Speaking about the security.. Will anyone tell me what flaws java7 bundled with Openfire has? Openfire is not a browser and Oracle's Java browser plugin is not bundled. So what's the real threat? Unless java8 deals better with all the SSLv2/3, POODLE stuff and has weak ciphers disabled by default.