Pixels (at least ordered from Google) allow you to unlock the bootloader without any exploits, so they normally have the best ROM support

GrapheneOS is where a lot of the security work that ends up making it to other Android devices starts

CalyxOS is a good option for more support for standard Google Play apps

LineageOS is the original big ROM, but I think last time I checked, you couldn’t reenable the secure boot chain