Didn't the firmware add their malware to windows boot files, if detected? Not an issue if you can use another os, but if you need windows for some reason...

That's obvious, and certainly the first thing I'd do upon receiving such a device. But given how Lenovo got caught more than once pushing malware (after promising they'd fix it), I worry the problem could be deeply engrained in their product philosophy, and as such, I don't know that I'd even trust their firmware.

But maybe people change, and maybe I'm just being paranoid and depriving myself unnecessarily from hardware that I would like. (FWIW, I have used Thinkpads and greatly liked their keyboards, enough that I do consider them for every hardware refresh).

The harddrive that came with my ThinkPad hasn't seen electricity since it left the factory, I replaced it before I ever turned the laptop on.

The hard drive isn't the only place malware can live (the BIOS would be one example of another place).

Well, you do what you can.