If you were suspicious that a drive was used before you ever plugged it in I bet you could identify it by immediately taking an out-of-the-box SMART snapshot and compare those values to a known good sample for that model drive. Drive manufacturers run tests when new, I doubt these Chia miners are trying to match up the powered on time and cycle count to a legitimate drive, they're probably just setting it to 0 and throwing it in a box.

Unfortunately I highly doubt the majority of these fraudsters will face any real repercussions. Maybe a few victims will be able to successfully issue a chargeback, after many months maybe PayPal and other payment processors will try to freeze some funds, but whatever happens the fraudsters will still come out ahead. They'll just start selling under a new name and continue for another 6 months.