I've also been researching this recently. I'd suggest starting from choosing which software you want to run, and then seeing what hardware it's compatible with. For example, DietPi [0] [1] (scroll down for list of hardware) is a slimmed-down Debian distribution targeting Single Board Computers (SBCs). There's also a similar, maybe more mature project called Armbian [2].

A lot of the SBCs come bundled with their own distribution, but it's usually out of date with mainline Linux and probably insecure in a bunch of ways. And even if you can boot to your own distribution, you might not be able to replace the bootloader (certainly not in any sort of verifiable way - how can you be sure there's not another hidden partition on the flash?). But still, for recently released devices, you might not have much of a choice, unless you want to do the work of porting your preferred distribution to that device. So make sure to do your own research about what the community has managed to run on a device before you buy it.

In terms of which mass-produced board will replace the RaspberryPi in popularity, I'd be looking at a few SBCs built on the open source RISC-V architecture. For example, the VisionFive2 [3] just entered production and will probably become popular; you can buy it from at least one manufacturer on Amazon already. PINE64 also has a new RISC-V board called the Star64 [4] which they released a few weeks ago (and which I've yet to see in stock). IMO, this architecture is where the future is, but at the moment you should expect to spend a lot of time porting software to compile to RISC-V.

Also, note that a lot of these boards can be pretty sketchy. For example, OrangePi has three different websites (.org, .net, and .com), with different contact info in the footer of each. And the default "getting started" story for most of these boards is "download this blob from Google/Baidu Drive, burn it to an SD card, and boot your device from it" - will it match the shasum of the firmware compiled from GitHub? Maybe, maybe not. Will the bootloader modify it? You probably wouldn't know if it did. So, be careful putting any of these devices in a critical part of your network (like using one as a router). This is what led me to ask a similar question [5] recently.

Personally, as per a suggestion in that thread, I ordered a device from PCEngines [6] (TBD if it's in stock), and I intend to turn that into a secure booting firewall. In the meantime, I just received a NanoPi R4S [7] to play with, but I won't trust it as far as I can throw it (which is pretty far, to be fair, it's a tiny device!). And next I'll probably order a VisionFive2 to experiment with RISC-V. Some other trustworthy-looking brands I found in my research are ODroid [8] and Radxa [9]. I also have a ~9 year old BeagleBone Black Rev C (which at least still boots) from BeagleBoard [10], who have produced some boards recently too.

[0] https://github.com/MichaIng/DietPi

[1] https://dietpi.com/

[2] https://www.armbian.com/

[3] https://www.starfivetech.com/en/site/boards

[4] https://pine64.com/product-category/star64/

[5] https://news.ycombinator.com/item?id=35568984

[6] https://www.pcengines.ch/

[7] https://wiki.friendlyelec.com/wiki/index.php/NanoPi_R4S

[8] https://www.odroid.co.uk

[9] https://wiki.radxa.com/Buy

[10] https://www.beagleboard.org/