Assuming that this isn't an intentional backdoor that they had to place, there is no defense, period.

Intentionally weakening people's system, MITMing their traffic, and inserting ads in private communication.

If an individual was doing this, let alone at this scale, they would be stamped 'hacker' and put in some dark prison for ten years. Now it's Lenovo, they will get away with an apology or a class action lawsuit at most.

Whoever decided to include this belongs in jail.