I've had good luck with an X201, W520, and T480 - all thinkpads. Haven't tried any of the lower end lenovo models. I got my W520 new and my other ones off craigslist.
If you're looking to get a preinstalled OS and from a refurb vendor, an interesting option would be buying from libreboot. Debian/KDE by default or you can choose your own distro. Libreboot is a good cause, and sales funds the project. You'll have the most secure bios on the block.
they only offer the one laptop, a T480. Not an HP, Dell, etc. Ongoing fixes to the UEFI and BIOS code are irrelevant as this has libreboot instead. That's like saying you're missing out on windows updates if you run linux.
And anyway the T480 is at end of life: