IIRC, the Thinkpad line was not affected, and wasn't it a external partner that planted the rootkit?
Correct.
> wasn't it a external partner that planted the rootkit?
Nope. The first time it was 3rd party software, Superfish, but Lenovo installed it and installed a self-signing root certificate authority to MITM the traffic[0]. The second time it was Lenovo's own software, Lenovo Service Engine, which they also installed themselves[1].
[0]: http://www.zdnet.com/article/superfish-stop-using-your-lenov...
[1]: http://www.zdnet.com/article/lenovo-rootkit-ensured-its-soft...