I'm reticent to get a ThinkPad because of Lenovo and it's history of malware/bloatware.
I'm always installing a Linux distro of my choice or a clean fresh windows image if i need it
OSX seems fine out of box.
the box has a false bottom
https://en.wikipedia.org/wiki/System_Management_Mode https://en.wikipedia.org/wiki/Intel_Management_Engine
You can assume it's compromised, but China won't share what they get with your government.
Even if scummy, I think the root kit thing was blown out of proportion. It was surely a slip up by people who don't care on a product line that's on a completely different league than the high end for home users, let alone the business line. Hanlon's razor clearly applies from where I see it.