It is highly unlikely any brand new units bought retail would come with anything greater then 9.2 firmware. Most likely you'll get something on 6.x or 7.x firmware at the latest. 4.x systems were the ones that are hard to find when buying brand new. But the new Gateway update means that finding one on 4.x is no longer necessary. Nintendo will likely cease producing classic 3DS/3DS XL units before they ever have a chance of being shipped out with 9.3+ already on them. So you are definitely safe to buy a brand new one from a retail store or a site like Amazon. Just don't buy them direct from Nintendo though.
Don't do that. They will almost always send you one that will be on latest firmware since they'll just do a warrenty repair on it (and their repair technicians are already instructed to update console to latest firmware at some stage in the repair process), or check it and see nothing is wrong and just send the same unit back to you.