The Linksys befsr41's usually come will all services and ports closed by default. You should be fine as long as you install the firmware updates.

BEFSR41 - EtherFast® Cable/DSL Router with 4-Port Switch
Firmware Date : 6/24/2003

From http://www.linksys.com/download/firmware.asp?fwid=3

Obviously change the admin password and dont allow remote administration and you should be fine.

As for buying things online: nihil usually has the most paranoid option and it might be good to follow that...