question

Yes, that's one of the reasons we added the Custom ID. While many devices change ID at least on a factory reset (and iOS devices generate a unique ID when a player installs your app/game on a device with no other apps/games from you), there are some that don't. So a resold device could result in someone being able to log into a pre-existing game. Obviously, this is something of a corner case, as it would require that the new owner download and play your games - but I do mean "games", not "game", since the account is at the Publisher ID level, which is shared by all games in your Studio by default.

So one approach would be to generate a unique ID, save it locally, and use that as a Custom ID. You lose out on some data if you go that route, though - knowing which of your players are using which device types is information that could help you in future planning. So at a minimum, I'd recommend also firing a custom event on the player's first sign-in, to log data on the device specifics.