What happens when you buy a new or used Android phone with malware baked into the OS image and a reset done through the UI doesn’t remove it?
There's inherent risk in buying a device from a third party that you may not fully trust, but that risk is in the hands of the buyer to assess, and to mitigate as appropriate. When the average person buys a used laptop from Craigslist, I doubt they're doing a full disk wipe and reinstalling the OS, and they're definitely not verifying the bios or other motherboard-level code. There shouldn't need to be some special case applied for tablets or laptops either. They're all just computers.
Yes, it might be possible to remove this warning with sufficient effort, but it is not like there is no way to compromise an iPhone.