In this case, Lenovo hardly is spying or even interested. The bad thing is they are

a) selling capability to advertise to you, without your real consent, and

b) when the do it, the implementation is so horribly broken that it exposes end users to be exploited by just about anyone.

I see little malice, I see a lot of incompetence and outright, unforgivable stupidity. This opens door to the malice of others.