For people wondering why there was no hefty fine, it's probably because the FTC had no authority to impose one. Except with regard to children, the FTC isn't specifically empowered to protect "privacy rights." The FTC brought a complaint against Lenovo under Section 5 of the FTC Act, which addresses "unfair competition" and "unfair practices." Historically, that meant false advertising or other abusive practices set forth in law (e.g. unfair debt collection practices). Under Section 5, civil penalties can only be imposed where a company violates an FTC rule, and does so with knowledge that the conduct violates the FTC rule (typically a Trade Regulation Rule ("TRR")). 15 U.S.C. 45(m)(1)(A).

There is no TRR addressing the kind of conduct Lenovo engaged in, nor any statute prohibiting such conduct: https://www.ftc.gov/reports/privacy-data-security-update-201.... While the FTC can declare particular practices unfair on a case-by-case basis, without a rule, in that situation it can only issue a cease-and-desist order. 15 U.S.C. 45(m)(1)(B).