You are better ordering from neither. Amazon group batches their inventory. Their "sellers" appearance is just a price fixing scam. There is no way to trace the stuff Amazon sources to any specific seller. So everything from them is sketchy. The same applies with eBay. Most people are legitimate, but there is no effective way to tell who is or is not legitimate.

There are two ways of looking at this. One, assuming you will install Graphene, the way Graphene uses the Trusted Protection Module TPM chip is to not trust any unregistered code. So a person will not be able to do much to the device to compromise it as far as I am aware. This is conventional type attacks. The second way is more abstract of what is technically possible but improbable and probably never happens in the wild. For instance, one unlikely aspect to be attacked may involve the modem. I am not certain what the Pixel's actual architecture involves between the SoC and peripherals. Often, the modem on mobile devices is another sophisticated microcontroller. This is capable and entirely independent compute device. The OS is interfacing with some kind of API, but is not privy to what is actually running on this hardware. If it was eavesdropping and communicating over cellular or WiFi, you would not know about it. These devices are undocumented and proprietary hardware too. The orphan kernel scam used to artificially depreciate hardware is based on the proprietary undocumented SoC and modem.