I'd go a step further and recommend https://grapheneos.org/ with a Pixel phone.

That too! It's restricted to Pixel devices though, and (I'm not 100% sure on this. It at least doesn't include it.) doesn't support things like MicroG which is a must for getting some apps that rely on Play Services to work correctly. I really think Graphene is only good for hardcore privacy and security enthusiasts, or for situations that actually require the security. I guess it just depends on how much convenience you want to sacrifice.

CalyxOS is another option. It's hardened but also has MicroG installed.

Serious question- how can anyone know these operating systems are truly secure? Is there a way to test the source code? From a code perspective could Google have placed a back door in Android to access these forks?

You can compile it from the source code yourself if you want. Realistically speaking there may be a backdoor in closed-source Google Play Services, but not in the open-source AOSP project.