I would never consider buying hardware wallet from anywhere, except directly from the manufacturer. It's very sensitive device in terms of security, and I think that saving a few dollars is not worth the risk. Even if user reset device there is always possibility that hackers modify hardware in some way, so you can get completely fake device.
Regarding OP advices, they are good, but in addition to good antivirus every device should have firewall and extra antimalware protection. Such software should be regularly updated with new versions and with daily anitivirus/malware definitions. Also every browser need adblock, it will prevent to user see bad ads when using search engines, and most of them are related to phishing sites and fake crypto wallets.