I typically buy older Lenovo laptops that I can put LibreBoot on, an open-source BIOS replacement. Then I open it up and disconnect the speakers, microphone, and camera. When I close the laptop back up, I usually place tamper-resistant seals over several locations.

For an OS, I run Whonix and have it configured so the system wipes the memory and shuts down immediately if anything foreign is attached or removed from USB.

Since I don't use any eSata or Firewire devices, if those ports exist I epoxy over them. There are too many ways to dump memory with direct DMA access.

If you were serious about a custom run of security-focused laptops, I think you would have a market for them. Dell and Lenovo just subcontract with manufacturers in China and it wouldn't be too difficult to contact one and give them the specs and do a custom run of laptops. Considering putting actual hardware switches for both the Wifi and Bluetooth.

I would certainly buy one!