Actually they did. It stored the malware in UEFI so after a format/clean reinstall of your OS you were still vulnerable.

https://www.ghacks.net/2015/08/12/lenovo-once-again-in-hot-w...

Honestly, we just accept what Apple, Google and Xiaomi are doing every day. Maybe they note it somewhere in the terms or not. The difference is, that we've access to the BIOS and higher expectations to Lenovo. On the other side "What Aboutism" doesn't help :(