Any one of the threats could be possible, but highly unlikely, if that is the case thou I would recon the person doing this is "professional" enough not to install these apps as 3rd party apps but would have probably flashed the device with a custom rom that includes these apps. If that is the case a factory reset would not solve anything, as the apps are part of the firmware, however, you can download the latest firmware for the device and re-flash it, this would ensure that you know exactly what is or isn't on the device.
But like I mentioned in the first line this is highly unlikely, and I would say that you are being over cautious and maybe a little paranoid(no offence intended) The reason I say this is that there is much better(cheaper) ways to get malware spread, and malware is normally spread on a mass scale, where individuals are targeted you might find something like that happening, but you would most probably have been given the phone for free...saying that you won some prize etc.
So chill if you like the phone and its a good deal, go for it....
BTW most off the time in those cases where the device is new but box opened the seller received the phone from there network, and prefer to stick to the phone they are currently using, most networks requires in-store activation...they turn the phone on, turn it off, and put it back in the box( This might network lock the device thou