Root)Clean partition(misc recovery)for malicious file

Hello everyone excuse me for creating a new thread but i couldnt find any info on this matter.

As a gift, my parents brought Samsung galaxy s4 from someone i dont trust who sells it. I factory reset the phone thinking its enough to clean everything.
After a while i feel unsafe because the person knows things out of nowhere and i found out many $py software are more advanced now that its installed via root and very stealth.

I read wiping the partition and flashing the rom could help. But limited to only boot, data, cache, system while other such as misc, recovery remain the same?

What if its hidden in there. i want to make sure just to be safe. On a side note the person is a techie and also know im careful and observant.

Whats your suggestion on this?
Can i check every files in it also find the hidden ones and make sure no suspicious file? but i dont know the original stock file lists for tge partition misc and recovery.

Please help. Any inputs will be very much appreciated.
Thank you in advance.