If there is no firmware update process that may be even more reason to avoid buying a used Trezor. No process to authenticate a device of untrusted provenance, yet bad actors could still figure out a way to tamper with the firmware (see the photo on the site of the unit in development with the cover off and an extra cable attached), or replace the board entirely.

A well-documented, well-understood firmware update process with mutual authentication (firmware and device must both be validated) might improve things for secondhand Trezor buyers.