To be fair, Microsoft are the ones that made this "rootkit feature", Lenovo just used it.
Modern Windows instead delivers OEM payloads of various qualities over Windows Update.
Windows Update is a delivery platform not just for OEM software, but also for component manufacturer software on self-built machines. Naturally, some of that software is shady as fuck.
Correct. It also doesn't seem too hard to fraudulently claim a device ID that nobody else has claimed.