The problem is that "audits" of those machines is itself a threat model.

The auditing needs to be controlled such that a malicious auditor doesn't compromise the machine.

State couldn't prove that the machines audited by a private group in Arizona weren't compromised so they had to replace them [0] to a tune of $2.8M.

[0] https://www.businessinsider.com/arizona-audit-maricopa-count...