Most of these devices came from small computer shops, major second hand resellers and even E-waste recycle centres. I assume the original owners had all been assured their data would be destroyed safely.
Not all were hard drives either - I had a full spread of devices from hard drives, SDD's, microSD cards, USB drives etc, the only restriction that I wouldn't physically replace parts to recover data, I didn't think that was reasonable.
Physical destruction like drilling through the drive platters or nand chips will certainly do it
as would a single pass overwriting all the data on the device - there are free apps to do easily, if you then want to recycle it rather than bin it. Just don't trust the local corner computer shop to do it for you and certainly don't just take it to the tip/recycling centre as is.
Secure data erasure or destruction is something I've always offered to my client (I produce a pdf certificate of destruction with the tracking IDs, device serial and photo for their records), I had no idea things were so bad retail wise as I've been entirely B2B. I notified the companies I had sourced the devices from but I've not had a response from any of them - no surprise