[windexh8er]

It could very easily be said that the majority of bloatware saddled on most consumer oriented PCs sold today introduce security risks for their customers. This is not unique to Lenovo but is standard practice for HP, Dell, etc. Unfortunately it's become standard practice to bastardize vanilla Windows installations by vendors in their own interest and not that of the customer purchasing.

If I were a consumer buying a Windows laptop for Windows use cases there is no way I would trust any hardware supplier's OEM build out of the box to not include bloatware that adds a level of risk out of the box that isn't worth completely wiping the disk (including restoration partitions). Whether it be for "support" use cases or more nefarious / gray areas it's a hard sell to say any one is exemplary better than the other. Maybe niche players and those that are selling non-Windows variants, but the reality is margins are thin on general purpose computing and so these types of angles become the norm. And the reality is Windows has lost it's way with regard to being consumer oriented. A default consumer build out of the box is already riddled with ad and bloatware. It's truly a cringe-worthy state of consumer options today.

[sandov]

The difference being that Lenovo did it at the firmware level. Even if you reinstalled Windows from scratch, the malware would still be installed.

[windexh8er]

Not exactly. It was bundled into the recovery partition, so if you used that to reinstall your machine you'd get the OEM installation which included Superfish.

However, if you reinstalled Windows manually you wouldn't have. Technically it had nothing to do with firmware.