Risks like this is why I don’t sell my old personal devices. A few hundred bucks is not worth the potential security compromise.