There have been several cases of the default OS installation being infected with malware. I would recommend always wiping the drive and installing your own OS. Firmware is less likely to contain malware targeted at individuals, but it might be outdated and have unpatched vulnerabilities.