used iphone security risk?

If you wipe the device before using it, then it's as-new. The only security risk at that point is you. That said, I would discourage you from buying a used device from a non-Apple reseller. Stick to a new phone or refurbished one from Apple. If you buy used devices, then you are at risk of the Find My Phone activation lock.

Activation Lock Problem

If you purchased the device second-hand, then it is useless without the Apple ID and password to which it is locked. If you don't have it, can't remember it or cannot get it, then the device is useless to you. Try to get your money refunded, if you can, or take it to an Apple store for an exchange provided they will help you. If you are the original owner, then take the device, a copy of your purchase receipt and identity proof to an Apple retailer where they may be able to assist you. For a deceased owner, you will need a certified copy of the Death Certificate, the device, proof of inheritance and proof of your identity. Take all to your local Apple Store for help. Note: there is no guarantee that anyone can gain access to the device.

About Activation Lock on your Mac - Apple Support

Activation Lock - Turn off Find My iPhone

About Activation Lock on your Apple Watch - Apple Support.

So as long as the device is properly wiped there shouldn't be any risk of the device having some sneaky software installed to secretly snoop on my info (e.g. man in the middle)?

Correct.

The risk is in trusting the seller has actually prepared the device for resale completely. Not simply an erase, but the previous users iCloud account was fully signed out.

Then the risk is that your seller will refund your money if the device is not usable due to activation lock.

Man in the middle is the least of the risks involved with used iPhone sales.

That's correct. You can always get a loan through Apple, put it on your credit card and pay over time, and I'm sure there are other options available. If you get snagged with an activation lock, then you are out the money but have a device that will never work for you. Does the seller offer any money back option?

Sell the Delorean and buy a cheaper mode of transportation.

Pretty sure your question has been answered.

If you need someone to validate your fears of malware, spyware etc. that won't happen here.

To repeat... if the device was prepared correctly, and you won't know this until it's in your hands, your experience should be a good one.

If the previous owner does their steps to remove their information and restore the device for a new owner then you have a "new" device that you can use as your own.

Don't buy one anywhere else.

If it has properly been removed by the last user you have no risks.