The phone is probably not new.
Check https://imei.info to verify that it isn't blacklisted.
If it were an AT&T native phone, you definitely won't get updates. AT&T requires you to have an active AT&T SIM card to get their update services.
Regarding the dodgy CSC messages, it sounds like it was wiped / flashed in a hurry and carelessly.
What is the full model number of the phone? I am interested mainly in the sticker on the back of the phone or the model number reported in fastboot/recovery. Do they correspond?