Damaged iPhone is my data secure

You can use Find My to erase the data on that iPhone:

Find your lost iPhone or iPad with Find My - Apple Support

Even though the context of that document addresses a lost iPhone, it describes how to use another device or iCloud to erase it.

It's not entirely clear to me just how the seller was able to determine the iPhone had not been erased. If I had to guess, he or she connected it to a Mac in an attempt to resurrect it or somehow return it to operation, and then either determined it could not be accessed at all or it was not properly erased. In either case though, it seems the seller is being responsible by returning it to you and asking you to erase it. iPhones are very secure in that respect — no one, not Apple, not the US's premier law enforcement agencies — no one can access the information on it. It's utterly useless to anyone other than its rightful owner.

So... where does that leave the seller? Unfortunately for them, if the iPhone simply doesn't work and it's returnable under the seller's (or Amazon's) return policy, they might just have to eat the sale. But that's their problem — not yours. Meanwhile the iPhone's data is secure, locked away forever, inaccessible to anyone. Reassure your wife her data on that iPhone is un-hackable.

If you had the phone secured with a passcode to open it and you had enabled 2 factor authentication, then it would be next to impossible to access any data. If the phone won’t start or is frozen, see if this helps: Restart an unresponsive iPhone – Apple Support (UK)