How is a Nexus device "provisioned" when you buy it from Google?
I saw this, and also looked into it briefly.

Basically, as you are using your Google Account when buying the device, Google will link your Google account to your Nexus device at the factory, and send your details to your email address.

This means that the Google account setup is already complete when you receive the device, so you can download apps as soon as you turn it on and enter your password.

It is unlikely to be encrypted, however as the password has yet to be entered no sensitive information such as emails or card details can be access should someone else receive the device.