A bought account belongs to two people until the password changes. It has to change — the only questions are when and how, because sudden moves are expensive here.
Why not in the first hour
Changing the cloud password is a conspicuous action. Done minutes after the account changed country and device, it completes a picture of a takeover, with the matching consequences.
A sensible wait is after the account has sat quietly connected for a few days — the first stage of warm-up.
The order
First close the other active sessions: those are what give the seller access right now. Then change the cloud password. Then, if there is an email, change its password too.
Leave hours between steps rather than doing everything in one minute.
What you can break
Your own access. If the cloud password is forgotten and you hold neither email nor number, there is nothing left to recover with — see recovering a locked account. Write the new password down before you set it.
And the session: on some clients a password change forces a logout. That is normal, but it means reconnecting — from the same proxy, not from home.
If no password was supplied
That is not «an account without 2FA», it is an account the seller still controls. Use those only for short disposable tasks — see what comes with an account.
Where to keep the new passwords
Where the session files are, and with the same attitude: these are keys, not notes. See storing accounts.
Buy accountsaged, with full session files