That's obvious, and certainly the first thing I'd do upon receiving such a device. But given how Lenovo got caught more than once pushing malware (after promising they'd fix it), I worry the problem could be deeply engrained in their product philosophy, and as such, I don't know that I'd even trust their firmware.

But maybe people change, and maybe I'm just being paranoid and depriving myself unnecessarily from hardware that I would like. (FWIW, I have used Thinkpads and greatly liked their keyboards, enough that I do consider them for every hardware refresh).