The Lenovo engineers I spoke with are concerned about firmware updates for these things too, and will be working with their vendors to make sure they're in the LVFS.