The Librem 5¹ is both more powerful then the PinePhone, and is slated² to get RYF certification³ from the FSF.

1. https://puri.sm/products/librem-5/

2. https://puri.sm/posts/librem-5-update-shipping-estimates-and...

3. https://ryf.fsf.org/

I was so excited after reading the specs but damn $899 is a lot.

There are tons of devices compatible with LineageOS. I suggest taking a look there. https://lineageos.org/

I'd go a step further and recommend https://grapheneos.org/ with a Pixel phone.

That too! It's restricted to Pixel devices though, and (I'm not 100% sure on this. It at least doesn't include it.) doesn't support things like MicroG which is a must for getting some apps that rely on Play Services to work correctly. I really think Graphene is only good for hardcore privacy and security enthusiasts, or for situations that actually require the security. I guess it just depends on how much convenience you want to sacrifice.

CalyxOS is another option. It's hardened but also has MicroG installed.

Serious question- how can anyone know these operating systems are truly secure? Is there a way to test the source code? From a code perspective could Google have placed a back door in Android to access these forks?

You can compile it from the source code yourself if you want. Realistically speaking there may be a backdoor in closed-source Google Play Services, but not in the open-source AOSP project.