I agree that there is a theoretical scenario that all the production line are trojaned, or that Lenovo is cooperating with the customer's adversary at assembly time. However, my question was intended for what is more likely the practical situation today: that only a subset of computers get the treatment, and that it is applied after the factory, as per the recently liberated information.

Apparently I do need to look into the whole "verifying firmware" area. Maybe I'll try to compare checksums and other data with other owners of the same model and BIOS rev, on a suitable forum.