If you install a decent OS replacing the one it comes with, there won't be any malware (at leat not the kind we knew about)
Short version, manufacturers can use a feature called WPBT to load executables into your “clean” Windows installation from firmware. It’s intended for providing drivers.