Couldn't you at one point do a reset without disabling any activation lock or find my device? Now I get a notice that it wants to disable find my device. Was it always like that?
I suppose, tangent, that if they knew the MAC address of the touch they could, but that gets into is it possible, or likely. Possible, sure, but likely? Unless the person you bought it from is a 2-gazillion on the psycho scale, it wouldn't be worth it to try tracking like that. And if you are leery, wipe the thing yourself, and do a restore...