Ledger says the private key is randomly generated only when you boot the device. How can you be sure?

Would it be possible for an engineer working for Ledger to generate the key, then re-set the device in a way that seems new and let the future buyer generating the same key?