Zero it and install Linux. Problem solved.

Basically none. You’ve got the ME (or AMD’s equivalent) on the CPU anyway so you really can’t avoid having some kind of root kit. Older Intel hardware that doesn’t have the ME or can be neutered is the best bet, and these machines don’t use UEFI anyway. Otherwise you could go for a non-Intel/AMD architecture, but there aren’t that many of those around anymore.

Clearly there's some component of UEFI that's in firmware, right? I don't really know all the terminology and such here, so please correct my understanding, but -- even if you don't have a disk, you'll get some UEFI bootloader. I seem to recall that some devices like many Chromebooks will have some extensive EFI blobs in firmware partitions, at least some of which is a read-only "get back to factory settings if you really screw up" stuff. I don't see what could stop a vendor from putting whatever they want into a a read-only firmware EFI partition, I'm pretty sure they exist in the wild.

If it has a SIM card, it is tracking you. If you leave Bluetooth or WiFi enabled, then it is being tracked. All the Librem 5 can do is 1) give trusted RF kill switches, and 2) not add additional tracking on top.

I will probably still buy one if it materializes, and is functional.

I have a librem 15. The screws inside the case seem to come loose every once in a while. Also I wish the body was a little more rigid (I'm guessing the librem 13 doesn't have this issue since it's lighter and smaller). Otherwise I like it. The speakers also aren't very loud so I often have to make the volume higher than 100% to hear clearly. I think the trackpad is fine using libinput (I haven't tried other drivers).

I didn't want to use PureOS so I installed NixOS and everything seems to work fine.

I used to have an issue where the fan would get stuck on high after resume, but I think that was fixed when I updated coreboot to the latest version.