2nd hand, and faulty, device sold as new

On Thursday 20/12/2018 I purchased a MyGica ATV495Max android TV box/media player at the Blue Route (Cape Town) store. When I arrived home and installed the box I discovered that the box was not new as it had been configured with someone's Google account, the Netflix was configured with a different account, the batteries had already been installed in the remote and worst of all it was faulty and kept rebooting. This was obviously a device which had been returned and was now given to me as a new device. If I was malicious I now had access to the original owners full Google profile (including his credit card information). This is very dangerous. The only excuse that was was given was "Well, sorry." and the device was exchanged. Is this an acceptable business practice from one of the nations largest retailers?