Short version: if I get a used google pixel from eBay that already has GrapheneOS on it, is there a serious danger of malware also being added (by the seller, not graphene)?

My iPhone is at the end of its life and I decided a while ago that I’m not getting another iPhone. I was gonna get just a normal android phone (probably a Samsung thought I did check out the Motorolas) but when I was trying them out they all shove that stupid Gemini ai shit down your throat. I was already aware of GrapheneOS but initially I was thinking I’d get an android, wait for that Motorola GrapheneOS phone to come out, and see if it looks worth switching to that since I’d prefer to not give google my money. Now though, I think I’ll just switch to graphene immediately for my own sanity

Since I don’t want to give google money by buying a new pixel tho, I was considering getting a pre-owned one on eBay that already has graphene installed on it. My question is if that’s dangerous. Like, can the person that puts graphene on it also add other dangerous stuff? Or is that not really a concern? Or should I just get a new pixel bc realistically me buying one phone, while not perfect to my values, is still not the end of the world? And that way I know it should last me for a good 4-5 years at least before I need a new phone. Also realistically, I will be running the sandboxed google play services for at least some apps so I’ll still sort of be “supporting” google in that sense

Also, if anyone has any advice/tips about graphene, I’d love to hear them! I’ve been watching videos about it and reading through the website’s documentation but hearing from actual users is always helpful!

Side note: I like how my brief lemmy post history is just me getting advice/support on my journey of switching to Linux/open source/user centric alternatives since I don’t know anyone irl that knows about this kind of stuff. Y’all have really helped so much in improving my life so thank you <3