I’d check https://transparencyreport.google.com/safe-browsing/search because most browsers including mozilla firefox rely on google safe browsing.
The other thing to point out is that if an attacker somehow got root access, they could install a so called “rootkit” and what it does it replacing some of the basic commands like top, ps, … with altered ones in order to hide the malware activities
Therr was spying concerns ever since they introduced intel management engine to their chips - which cant be easily disabled - but this arricle is not about that