Thinking about the risks I’m somewhat torn. As noted above, buying from a reseller that wipes and reinstalls the OS is likely to avoid the worst of issues.
A reset on a iPhone wipes the user data and does a fresh installation of the latest version of the OS. That is pretty good. However if you take that phone and treat it as a virgin installation, there remains the possibility that the previous user has managed to jail-break it after the reset and installed malware. So I would be inclined to be safe and do a full reset and installation myself before using it. Jail breaks are hard, but never say never.
Is this guaranteed to be safe? Well probably, but not 100%. Whether there is a modern equivalent of a boot block virus is likely unknown.
In particular, in any modern computer system the question remains of how the internal management processor and its software work. This isn’t part of the OS, and is never exposed in ordinary use. It sits in the background and is responsible for low level operations and possibly things like managing the secure enclave. An exploit to insert a hook into this software can be incredibly hard to find or fix. If it exists. There is a huge effort thrown at keeping this part of the system safe. Exploits usually require sophisticated access to the internals of the phone and very high end equipment. The level of integration of the components of a modern phone make this the province of government agencies, not random people wanting to steal your details. And again, that is if an exploit exists at all. Famously Apple refused to provide the US government with an operating system variant that would allow them to use another exploit allowing security to be broken. And the exploit the government agency wanted Apple to give them leverage on is long since gone.
TL;DR
I would be comfortable buying a second hand iPhone, but I would do a full reset with its OS re-installation myself.
The above is really iPhone specific. Being a fanboi since Apple broughb ot the first Mac, I’m happy with living in the walled garden and with what that brings. YMMV is you want to go with another platform. The variability of the Android ecosystem gives me no such confidence.