I've been wondering about which level of trust I can apply to a used phone bought from someone else. I can easily unlock the bootloader and flash a brand new Android. However, what about firmware customizations? What if there is something bad that runs before Android boots?
I'm not talking about something that the manufacturer plants in the phone, but something that the user or malware might have done.
It's more a question of how easy it is to run things on Android beyond the flashed image. Can anyone do it with basic tools, or is this something hard, exploit-related that might be possible on some specific brand?