I'd check https://transparencyreport.google.com/safe-browsing/search because most browsers including mozilla firefox rely on google safe browsing.
The other thing to point out is that if an attacker somehow got root access, they could install a so called "rootkit" and what it does it replacing some of the basic commands like top, ps, ... with altered ones in order to hide the malware activities
Therr was spying concerns ever since they introduced intel management engine to their chips - which cant be easily disabled - but this arricle is not about that