Can a Used Android Phone Have Hidden Hacks or Viruses?

Typically, malware doesn’t stick around after a factory reset on Android devices. It’s quite rare for someone to install hardware that would interact with the phone itself. Unless you’re in a situation where you're a target of serious espionage, the chances of having hidden hardware are nearly zero.

Just out of curiosity, what does "rooted" mean? How does that come into play with security?

Most people won’t go through the trouble of installing hardware on phones. If your phone isn’t rooted, a factory reset will wipe out any lingering software. You're pretty safe if you take that step!