In regards to POSSIBLE malicious tampering you want to select a distribution that is LIBRE and endorsed by the FSF.org like trisquel.info
It has all proprietary code and binary blobs removed from the Linux kernel. Perfect for ThinkPads.
With thinkpads you can also replace the bios with LibreBoot.
With LibreBoot and Trisquel, you will have the ultimate protection against malicious code or bios tampering.
For example, I dont do any bitcoin stuff on anything beside my Trisquel ThinkPad machine which has libreboot and is wired ethernet only.
Why take risks.
For daily usage and non mission critical stuff, I have a gaming PC with Linux mint and multiple virtualboxes on it.
Let me know your thoughts, happy to discuss.