Don't buy refurbished, buy a new one. You can get a great machine for a couple hundred bucks for this purpose.
Ideally, and in most scenarios, it is probably not necessary to use a clean environment with a hardware wallet. The hardware wallet is designed to defend against these external threats well. In view of this, a refurbished one is more than enough. You should wipe it and install your own OS as well.
This is not true, there are sometimes exploits that can be used or manipulations through the software to trick the user. It is better to do things with clean devices. You save little money for a lot of added risk. Why not avoid this if you can?