Good catch!  Just bought a Thinkpad T470 for around 100€ for a family member and installed Kicksecure (hardened Debian) with whonix in a VM.