every once in a while there's a lenovo default windows image/hardware security controversy, but never one that has affected me directly.
i don't care what they put on the default windows partition (i replace it on arrival) and the uefi issue was a production mistake where they imaged with a nonproduction image.
they're still used widely by serious people in academia, open source and security sensitive industry.
i suspect a lot of the bad press they get comes from the fact that there's a lot of very sharp eyes making use of their gear and that similar issues happen in other lines but just go unnoticed.
if you're truly paranoid, a pine arm machine or fully open source risc-v may be your jam. everything else is going to be loaded up with proprietary blobs everywhere along with overcomplicated supply chains and overzealous marketing departments cross selling adware onto that default image you should be tossing anyway.