I guess it depends how paranoid you and your girlfriend are. See https://www.vice.com/en_us/article/ypwkwk/the-nsas-undetecta... Short of physically replacing the drive, I don't think there would be much you could do, in that particular circumstance.
It's a macbook air so technically they can't do that as the hard drive is embedded to the motherboard, right? Also, all data are/were encrypted using Bitlocker (average strength password) - forgot to mention the mac was running on Windows 10, work computer.
solder on a new drive...