[nope96]

Re: #2 - The UEFI bloatware/rootkit checked the Windows version: if you used Windows 8 or up it used the "feature" called "Windows Platform Binary Table", but Windows 7 didn't have that, so for Windows 7 it overwrote CHKDSK.EXE with a Lenovo loader on every reboot. So, yeah, they were overwriting OS binaries on disk, not just relying on WPBT. (But no reports of binaries being overwritten on on Linux)

[autoexec]

I'm surprised they got around windows file protection! That had been around since at least XP so I wonder what they did to avoid it.

The writers of the malicious software lenovo has so far been caught including in their products were specifically targeting windows users, but I see no reason to think that they wouldn't include malicious software that targets linux if some seedy company decided it was worth the effort to write it and offered lenovo enough cash. Their total lack of integrity and respect for their customers is enough that I could never feel fully confident that I was safe just because I was running a non-windows OS.

[DANmode]

Windows File Protection seems ineffective against malware signed by a Microsoft vendor.

and/or for malware that can disable WFP.