Strange situation. Yes UEFI is huge and there is plenty of room for Intel ME or AMD PSP.
Vendors build in quite some more remote management.
Look into coreboot and heads a bit. Have a read in their documention. One principle is to initialize hardware, hand it over to the payload, which does a few things and hands it to the OS.
The firmware then should not run anymore or as little as possible, as it has the most access to everything, more that the OS with full root access.
So yeah, dont trust that laptop. They have a mini-OS in there which can spy on you, they can also use it for "persistency" i.e. placing malware in your OS even after a reinstall.
An easy fix would be to use NixOS or Fedora Atomic Desktops or something, where they simply cannot just install programs.
But yeah that is a guess. Dont trust proprietary firmware. Chromebooks can be flashed often, System76, Novacustom, 3mdeb, Starlabs all have Laptops with coreboot support.