CPO also doesn't cover a bunch of the electronics (nav, stereo, etc...). IMO CPO on a car that age isn't worth what they are going to try to get you to pay for it. You'll likely have a year worth of coverage at maximum as the CPO policy starts from the vehicle's original purchase date not when you buy it and a lot of '07s are going to have been bought in '06 or the first half of 07.
Carfax can't be trusted to mean the car hasn't had paint work or been in an accident either. There are a lot of times things don't appear on the carfax. I would say if you find a car you are serious about ask the dealership to let you have an independent mechanic inspect it. It might cost a couple hundred dollars but, it would be worth it.
Last, don't "trust" any dealership. Just because they are a big fancy dealership doesn't mean they are honest. I've had the GM of a larger BMW dealership lie to me about the condition of a car that he was using as his personal demo. The bastard told me the car was pristine, let me drive 5.5 hours up there in a one way rental car to buy it while flat out lying that it had never had paint work, or been smoked in when he was the one smoking in it. They are all out to make a buck. If they get screwed on a trade in they will try to pass that screwing on to you. If you don't know what you are looking for in regards to trouble signs bring a friend who does.