Security on a Nexus 6P purchased on Ebay
Theoretically, a factory-reset wipes data only while any deep seated malware that injects itself into the /system partition isn't wiped. To that extent you have a valid concern.
Fortunately, you have a Nexus device. Google provides factory images for Nexus/Pixel devices (here). You can flash the factory image for your device following instructions on that linked page. See adb tag wiki, if you aren't familiar with adb. It might look a little complicated if it's the first time you are doing this, but it isn't.