> It's easy enough to design them to behave correctly in all cases except actual elections

How? Any possible scheme I can think of that could theoretically allow a tabulation machine to behave differently on audit ballots than it does on real ballots, can also theoretically be mitigated via audit procedures.