"but they can be removed by doing a clean install or just using a brand new (known clean) VM disk image."

Not necessarily ?(firmware, bios etc...)