They might have started it over 10 years ago, but they kept the Superfish malware until 2015, when they offered removal tools.

(For context in the future, this comment was made in 2022, when the Superfish Lenovo security controversy was only 7 years old.)