She might have bought second hand. You can get here unknowingly some shady origin phones second hand. After I carelessly got one a few years back, I noticed it had burned in AT&T icons on the screen. So...yeah, you never know here.
Regarding the KNOX status which I guess you might be referring to, you shouldn't be able to trip it if you're still installing 100% original firmwares, unmodified on any way. AFAIK sammobile only hosts original firmwares. You should be able to change between countries/zones by swapping the firmwares (bearing in mind there's always at least two versions of any samsung phone, the Exynos and the Qualcomm CPU versions...then sometimes variations with/without extra SIM, or SD card slot). If it's a different model (like, different physical hardware) it should refuse it, but I'd rather not try that. And if you install some modded firmware, that's when the Knox fuse will be tripped, and Samsung Pay (and many other Samsung secure-related features) will be locked permanently and rendered useless.
A lot of more detailed guides and info might be available in XDA forums.