I also don't understand why anyone who cares about these issues would buy HP - they're establishing a great track record as a company that really wants to spy on their customers[2]. Almost worse than that is how incompetent they've been about it - a couple years ago it was FinFisher, and I believe they somewhat recently shipped a key logger in a driver by apparent accident.

For my part, my machines save one run OSes that expose full control of the machine[3]. OSes that don't, like other untrusted software, run in VMs so that I can still control them. Windows instances don't get network access anymore. I only use it for a couple apps that do what they need to do, so the bottled demon doesn't need updates until underlying needs change. It makes life much easier when a whole class of problems can't happen.

[1] Which is as it is 'supposed to be', as the rules are currently written.

[2] Not to mention board members...

[3] Yes, cellphones; not a novel observation. That's a different discussion that I've had several times here.