Hypothetical questions like this are difficult to answer and are thus discouraged. In order to be able to receive specific answers, you would first actually need to have been infected by the malware. Second, you would need to be capable of discovering, extracting, and analyzing said malware before anybody would be able to tell you what you should be worried about. So, I will hypothesize about the worst case scenario.
1) If I assume that the BIOS, SSD, or NIC firmware is indeed compromised from the previous owner, what are some of security features that something like Qubes OS will provide me despite this?
Without knowing the exact capabilities of the malware, the worst case is that Qubes will not offer any protection. Since those components are at such a low level, compromised firmware could allow unobstructed access to all hardware and software on the computer. Virtual machines are no more secure than the hypervisor they are running on.
2) I have read that installing AIDE/Tripwire on dom0 at the beginning of a fresh Qubes OS install can be a powerful tool to see whether the BIOS malware infection is going to damage the dom0 and other downstream VMs in any way going forward. Do you think this is useful?
It would be interesting to see the source of this claim. If the BIOS is truly compromised, capable malware could likely hide itself from any sort of userspace detection, so this wouldn't do you any good. AIDE/Tripwire keep track of file integrity, and I believe they encourage use of an external database so that it is less likely to be tampered with. Even if the malware needed to modify your userspace files, it could also probably replace or interfere with the functionality of these tools to evade detection.
3) The manufacturer website has downloads for BIOS firmware, SSD firmware, wireless LAN/WAN, etc. My BIOS and other firmwares are 1 year out of date. If I update these firmware over windows, and then wipe windows from SSD and start a fresh Qubes OS install, will the firmware stay updated? And will it also remove potential malware that was previously infected?
Again, this depends on the capabilities of the malware and the method in which firmware is updated. Maybe the malware doesn't allow its firmware to be overwritten through the normal vectors. The only way to override anything like this would be to flash the chip directly with SPI or JTAG.
4) What are some good practices for preventing these types of firmware attacks? My system uses TPM 2.0. Is there a guide to get TPM2.0 working with dom0 to check and analyze logs? Is it a good practice to turn off/not update intel ME, disable intel TXT, AMT, and secureboot? Because that is what I did.
The only way to prevent it in this case would be to buy a computer that isn't already compromised. I do not know what TPM has to do with logs. Without looking each one up, those Intel components may add some unnecessary attack surface and should probably be disabled. I also don't know of a security-based reason for why you'd turn off secure boot, since it can prevent some attacks (but won't likely provide protection against this type of malware).
TL;DR: maybe don't worry so much about something like this, since it's theoretically very hard for anybody to defend against it, even a security expert. If you really have to worry, buy a computer from a trusted source and don't ever let it out of your sight.
