That's why old devices must be properly cleaned of personal data before being sold or discarded. I buy most of my devices (network stuff, APs, laptops, etc) eit

That's why old devices must be properly cleaned of personal data before being sold or discarded. I buy most of my devices (network stuff, APs, laptops, etc) either as refurbished or at flea markets. If I was a malicious actor I could have easily taken advantage of many people who didn't delete their data, including WiFi settings, from a device they gave away, so although devices are used in relatively safe places like home or workplace where it would be impractical if not impossible to gain physical access for the time necessary to exfiltrate sensitive data, that becomes trivial if the device is discarded/sold without taking proper measures to delete any sensitive data it could still contain.