I'm thinking of buying a used tablet with Android and installing user land then installing the Monero GUI in user land. Is this a security risk?
As with any used computer, I'd advise wiping it, reinstalling the operating system before using it, to ensure the previous owner hasn't installed anything malicious on it.
Then running Monero on it will be fine. Running in userland (user space), is preferred.