Asklemmy

but once it's written, any common criminal can use it.

It's not that simple on ARM world, every device uses a different bootloader and has a different partition layout, different boot image resolutions and different type of warnings. So you'd have to a custom bootloader written for each model you sell, or just pick one model and reduce your audience.

They could use the compromised phone they sell you to phish or ransom you.

It's far more safer to just compromise a website or phish via emails/websites/fake apps, instead of selling malware on eBay and risk getting caught. And way way more easier to just make fake phone calls and pretend to be Microsoft support and then grab their credit cards or install malware on their PCs. So many easier and safer (anonymous) ways to scam people.

All of those only work if the software already on the phone allows them to work. Factory resets, updates, and USB flashing are all implemented by software.

Now you're entering the realm of really hypothetical scenarios here. Sure, what you're describing is theoretically possible, but faking the fastboot firmware is even more advanced than just simply patching the bootloader warning screen. If something like this was happening widely, we'd have heard about it by now. After all, Android phones have been around for 15 years. Now there have been a couple of instances of dodgy no-brand manufacturers/sellers shipping malware, but even these were just simple userland malware, nothing at the firmware level.

If you are that paranoid, then I guess you don't buy any piece of electronics from any retailer, and buy everything directly from the manufacturer always? I suppose you also walk directly to the factory, personally inspect the entire manufacturing and software development of the phone you intend to buy - because you don't trust the supply chain right? Sure, you may trust the manufacturer, but do you really trust the parcel package, the driver, the delivery person? Where do you draw the line exactly? Because in your hypothetical world, anyone can be a hacker right?