I've personally run some recovery programs on a Samsung replacement drive I received (from Samsung, not Apple) and I was able to recover files that presumably belonged to a previous owner. I didn't bother checking if it contained any personal information (I was only interested in recovering a corrupted dotfile), but it seems possible that sensitive information could have been contained on said drive.