This is why you should never buy/sell electronics used for sensitive stuff like this second hand. Cases like this might seem bad but are still quite isolated and unlikely, imagine if the seller deliberately implanted malware, or buyer trying to get past your 2FA.
Or companies should be required to have a "factory reset" and warrant its removal of all customer data and associations (with heavy minimum compensations for failure).
