On a PC, Intel ME and the like can be accessed remotely only through an Intel NIC, which can be avoided by using a PCIe Ethernet card from another manufacturer, if the motherboard does not have such an interface on it. Even many of the Intel Ethernet interfaces are supposed to have the remote access disabled from the factory, but you cannot be certain about this.

A more serious problem is caused by the laptops having Intel WiFi, which is difficult to replace. With such a laptop one would have to disconnect the internal antennas and use an external WiFi dongle, to be sure that remote control is not possible.

At one point laptop wifi cards seemed to mostly be m.2 cards, which, while not usually trivial, were relatively feasible to swap out. Has that changed?

A lot of the time, they lock the slot to only their officially supported modules. Dell is rather notorious for doing that.