https://phoenix.craigslist.org/evl/sys/d/chandler-buffalo-terastation-pro/7248559441.html

Thinking about buying this because it seems pretty cheap. If I were to buy it, I'd probably eventually swap the drives out for higher capacity ones.
My concerns about using a NAS someone else owned prior... is the concern over the possibility the previous owner might leave some hardware/software backdoors. Perhaps expecting whoever buys it, to put sensitive data on the NAS.

I've never owned a NAS, so I figure you could wipe the drives. Not sure where the OS is stored on a NAS like this... but whatever disk that is, I'd probably have to format it and reinstall the OS just to be on the safe side.

As for hardware, I figure I could open it up and just look and see if there are any suspicious things plugged into the Motherboard.

I want to have a NAS, but I really really want to save as much money as possible. I was even thinking of making one out of a Raspberry Pi 4 and a 4-bay HD Enclosure, but from what I gather... You can't really do any RAIDs on a Pi.

The firmware for units like this is typically stored on internal flash memory. While it could be compromised in some regard the likelihood is pretty low. I'd be more worried about what the Chinese have in the factory firmware.

I would factory reset the device and then perform a firmware update via the recovery mechanism using TFTP. That way is going to provide the greatest assurance that nothing malicious remains.

Agreed. Get new hard drives. Flash the Bios.

Enjoy your new NAS.

I'm running an 8 year old QNAP we took out of production at work. 2GB RAM and a 2nd gen Core i3. 8 bays. Turns out you can swap out the i3 with a 4C/8T Sandy Bridge Xeon and bump the RAM to 8GB. It runs like a top now.

I decided to go with a Raspberry Pi. After looking into the specs of the NAS, it seems a Raspberry Pi 4 would actually outperform it by quite a bit. Plus with the Raspberry Pi, I'd be able to set up additional services on it and likely to be better supported.
I don't think I'm going to do any Raid stuff.

From what I gather, RAID isn't really necessary for home use since Redundancy =/= Backup. Correct me if I'm wrong, but RAID only help ensure that if one of your drives fail... your other drive can keep serving files (aside from Raid 0, obviously). But if I'm going to have multiple copies,... that's fine. In the unlikely event of a drive failure... I can just turn off my PC. Run out, and get a new Drive... swap it out... and then turn my PC back on and upload everything again.

Outside of production/business environments,... there really is no need for RAID.

It all depends on the data. If you don't have raid and you lose a drive you lose everything to the last backup.

Mostly correct. As the post after yours states, if you lose a drive in the RAID array, you can keep going and don't lose data. If you lose a drive in a "production" machine that isn't RAID you are reliant on the last backup.
That said, RAID is not a backup, is for redundancy and keeping a dataset active.