I had a Thinkpad X1 Carbon Gen 10 that, by the books, should have been a beast with good Linux support to boot. I tried for so long, but ended up replacing it with a Framework.
The thermal management on the Thinkpad is awful, under Linux at least but by all accounts attributable to the EC itself. Running the most basic workload would cause the CPU to spike for about one second before it would throttle all cores back to 400 MHz where they would stay locked for the next few minutes despite the CPU temps remaining at 50-60°C the entire time.
And it wasn't just me, numerous reports from all over. This made the system nearly useless. I shared pages of diagnostic info with them and they just seemed completely uninterested in trying to do anything about it.
Spec'd out equivalently, the Framework 16 (without GPU) is no more expensive than the X1 Carbon but with even better Linux support and unsurpassable upgradeability. I'm glad my company was onboard for me to switch.
If you like anonymity, then the Retro thinkpads should still be the best as they are numerous and hardware profiling is useless (if you are a TAILS or tor user -- "Windows" everywhere!).
Also, check out the "hardware compatibility list" from Qubes OS (they've got an endorsement from Snowden right on their homepage). The i5 and i7 Intel CPUs virtualize and are very well understood by people that work with Xen. Notice how Intel just crashed with the latest generation CPU lines. Just because it is brand new, doesn't mean it is highest security and reliability. (For example, nuclear silos sometimes still use floppies and are air gap compartmentalized with people in the loop. Might not be best for all the nukes to be on skynet and latest videogame capable. Depends on what you are doing for what is "best.")
Something some thinkpad users value a lot is the trackpoint. I'm seriously considering breaking a 4 thinkpad (3 X2x0, one X1 carbon) spree with a 13" framework but not having trackpoint is a big issue for me. I'm using the fact my X1 is still fast enough for my use to wait and hope for framework to get a trackpoint. There're more people in the same boat in framework's forums.