Security on a Nexus 6P purchased on Ebay

I purchased a used Nexus 6P on ebay to replace my current 6P, because the camera has failed. The seller indicates that the new phone has been factory reset, but I'd like to be sure that there is no spyware hidden deep in the system. On a desktop machine I would erase the hard drive, install the operating system of my choice, and be confident that most reasonable vectors of attack were removed. (Sure, he could've hidden something in the firmware of a device or whatever else, but I'm not worried about that level of sophistication). I'm not sure how Android factory resets work, but given that the phone's memory is never completely erased, I worry that a malicious actor could have put bad software into the image that the factory reset restores from. Is this a valid concern? If so, is there a way to address it and be sure that my phone is not sending all of my information to some one else (other than google)?