You can’t jailbreak a phone without already obtaining full access to the device. So, unless people are jailbreaking their phones before giving them away, that is not a likely scenario. You also can’t use a phone that was wiped unless you first remove or have the credentials to the iCloud account associated with it. So, they could wipe the phone, and then it’s a brick. Only if they have the appleid password Can they wipe it and use it as new, and only if they have the Lock Screen passcode can they jailbreak it to wipe it via exploits.

That said, there are other tools and methods, the most common being transferring a known good serial number to a locked phone, and remote iCloud unlocks are available from China, using the official Apple unlock servers, so not a technical exploit, but a human one.