The so-called spyware was on the cheap consumer lines using code written by Israelis. Some extra "feature" they thought consumers would like had a phone home aspect. There was also another exploit where some badly written code on another set of consumer units basically eliminated a normal security feature for communicating on the web. Can't remember the details. These two issues weren't just Lenovo and were never on the Thinkpad units.

My recommendation has been to buy the business oriented hardware from Lenovo, and Dell, and HP etc. Better hardware for not a lot more money, and they don't sell access to third parties to put stuff on the laptops to make up for the lower prices.