And what do you buy?

I've moved years ago from Dell to Lenovo. And specifically to professional models which come with onsite warranty.

The onsite warranty is of course very good thing on its own, but I also believe it puts pressure on the vendor to focus on quality and getting issues sorted out quickly (because doing onsite visits is not cheap). It also indicates the computer is built in a way I can also replace parts, because you can't field service a machine that has been glued together.

And what about the backslash from Lenovo SSL hijack from some months ago ?

It really looks like there are no pro or business solution, just a more expensive variant of `pick your poison`.

What about Dell's SSL cert debacle? It's not much better.

https://www.kb.cert.org/vuls/id/870761

Only way to escape the issues is to remove the bloated OEM OS that vendors provide and do a clean OS install (e.g. Linux)

Pfff. I missed that one.

The X1 Carbons have quite a few models with the RAM chips soldered to the motherboard.