This is very common. I've bought machines at auction with databases on them.
I've acquired over 100 used computers, and, once I saw how common leaving data on them was, I began always very promptly DBAN-ing any disks, and wiping SSDs. If it has a non-SATA interface, I destroy the medium. Similar with some kind of wipe of smartphones.
Besides wiping the disk/device seeming a responsible and considerate thing to do, it avoids remote yet severe liabilities.
A secure erase should wipe all blocks (and since it is done by the firmware, physical blocks, not logical ones), but there have been instances of buggy drives that don't actually do it properly.
Some SSDs also transparently encrypt all data written, and the key is replaced on a wipe command. Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly.
Quite old SSDs might not support any of this.
Unfortunately, you can't trust the SSD firmware developers to have their shit together [1].
[1] https://techcrunch.com/2018/11/05/crucial-samsung-solid-stat...