There are steps you can take to avoid ending up with a device that's been compromised even before you've started up your new phone, but nothing can guarantee you'll get a clean device