If
so, what do customers need to do so their user and configuration data on the
device and associated systems (e.g. cloud-based services used by the device)
are not accessible by the party who assumes ownership?

The user can restore the device to the factory
settings according to the device operation manual. And then, the user data will
be cleared, and third-party users can use the device.