Personally, I agree with the op. If we want to send a message that malware in our BIOSs is absolutely unacceptable, it makes zero sense to give Lenovo any business.
Anyway, I don't usually buy or not buy a computer to send a message. I buy one because it meets my business and personal needs. I've been using ThinkPads for over 20 years, and they have served me very well.
You may choose differently, and of course that's fine.
It sends a message to other manufacturers: add malware at your own peril. I frankly consider it unethical to buy or recommend products from companies, like Lenovo, who demonstrated anti-consumer behavior because it perpetuates bad behavior as companies think consumers will forget or forgive them.
> ThinkPads never had that, and never would.
That is speculative. I can't know that whatever harmful and irrational environment that led to Superfish in IdeaPad won't affect ThinkPads in the future. Even in the most generous understanding where IdeaPad is a different, physically separate branch of the company, and Superfish was an act of incompetence and not outright malice I can't be expected to keep up with the insider intrigue of the company to notice any changes that could negatively affect me. More importantly, leadership is still responsible for setting irrational environment that lead to Superfish, whatever that environment was. This is a multi-billion dollar company, there is no excuse for such incompetence.