If you didn't order it, it's free
Ohio -- like most states, the US Federal government and the UK -- has a law like this one:
Ohio Revised Code 1333.60
Voluntary delivery of unordered goods constitutes unconditional gift.
Where any merchandise is offered for sale by means of its voluntary delivery to an offeree who has neither ordered nor requested it, the delivery of such merchandise constitutes an unconditional gift to the recipient.
This law is because, before the Internet, shady businesses would target small business (by cold call or visit), get someone's name, and figure something they can use (inkjet cartridges, light bulbs). They ship those items unsolicited. Then they send an invoice under that person's name, wildly overpriced. This law breaks the scam by letting businesses argue "We didn't order it".
It could be a failed interception
The package is for them, and they planned to snatch it off your stoop, but you got there first.
A common scam is perpetrated not against you, but against the seller. It is not identity theft of you, but of some other poor sap. They were merely borrowing your shipping address.
Very likely it's a solitary perp operating in your neighborhood, who has obtained a list of stolen credit cards off the dark web. He specified a faraway "bill to" address possibly so it would match credit card data. He obviously didn't use his own house as a ship-to, because that would lead police right to him. So he used yours, since he goes right by this every day after school or work.
He already noticed your house has little activity, and he doesn't have a Ring or Hello camera-doorbell, packages sit for awhile undisturbed, and they're infrequent. (Too often means he'd confuse your packages with "his").
And this one was a miss; you got there first. He will simply order again from a different vendor, probably shipping to a different address. It costs him nothing to try, he has many credit card numbers and many online stores. This may have even been a test to see if you're a suitable destination for more valuable packages.
This isn't a huge security exposure for you because he only has two aspects of data: the physical street address of the property (gotten off street signs and house numbers), and a name associated with the property (homeowner name from online tax-roll data, your Welcome mat, mailbox, or a package that he saw on your stoop). Since anyone can already obtain A name associated with any street address, this doesn't add any significant amount of risk for you.
One aspect of this is that unlike brushing, the packages will be fairly valuable. Since he could steal anything why not steal something good? Also the plan may be to resell this, and a highly resellable item would be preferred.
It might be Brushing
I doubt it in this case, but it's worth mentioning.
Brushing is shipping a product to random people so they can write a fake review. They don't care who the person is, or about the fate of the product.
Amazon and some other companies open their website to third parties selling their goods. I'll talk mainly about Amazon, but it applies to others as well. On Amazon the product may say "Ships from and Sold By Some_name_not_Amazon", or may say "Sold by Some_name_not_Amazon and Fulfilled by Amazon". (The latter means the seller has paid extra for it to be in Amazon's warehouses and ship with Prime). The third party items are blended into standard search results, ranked partly based on user reviews.
Many new sellers (especially of cheap Cheese junk) can't get good reviews, so they set up a bunch of "sockpuppet" accounts, and write fake reviews. Amazon (or other platform) is onto this trick! It's devolved into an "arms race" between fake reviewers and highly competent engineers. The upshot is, for cheaters, the winning play (given how ridiculously cheap these items are) is to ship actual items to real random people all over.
Which doesn't matter to them since the items are very, very cheap. An item I've seen recently competed with quality $37 items at a $30 price point. The manufacturer sells it for $1.06 in quantity on Alibaba. They don't want the product back. It did its job, it let their sockpuppet write a review.
The brushers don't care about your identity; all they need is for the package not to bounce back to Amazon. All they need is a name/address pair. The address can be generated randomly using demographic data (middle-class ZIP codes) and picking a random street and USPS-validatable random street number. The name can be pulled out of a Register of Deeds tax roll database. This is not a security risk, per se, because they have very little, you can't protect that data (short of forming an LLC to own your house), and their intent is not nefarious to you particularly.
The "You received it, you must pay for it" scam
This is the scam mentioned at the top of the post. I doubt it will happen here, but if it does, you can say "NO" with confidence.