If you’re paranoid, install a new drive, reflash/update the motherboard bios, clear the boot picture (a proof of concept rootkit storage vector was there), factory reset the motherboard, clean install an OS, install software from trusted sources only, don’t let any stranger use your PC without you watching, take extra steps to encrypt your drive, and finally securely limiting privelege escalation to what you explicitly authorize. You’d be in the clear against 9999/10000 of attacks (I have no citation for this figure). You’d have to be super important, like a diplomat, tax chief, Microsoft IT director or small country royalty or something if you are to be targeted through an old ThinkPad.

(Tinfoil hat time)

Are you trying to evade info-stealing hackers, or the feds? From feds you’re somewhat out of luck, Intel ME and AMD PSP, in conspiracy-speak are kinda like government backdoors, closed source, undocumented, with huge control over a processor. AMD example intel example. Apple hardware is no better, you had better hope they haven’t conveniently slipped up and left an arbitrary read write endpoint in the software.

(Tinfoil hat off)

Assess your risk and threat level and take appropriate mitigation measures. The vast majority of exploited vulnerabilities will be through social engineering rather than software, and then software rather than hardware. The lowest hanging fruit is when there are open, easily accessible connections from the internet, software that can be exploited to freely escalate privilege, a user unwittingly leaking a secure credential, or physical access to a device by someone knowledgeable.