Ok, let's just do that : spec a voting system. Such a system should be as secure as physical paper and anybody should be able to assess its security by inspecting it (good luck with that one).

The level of detail your talking about to prevent the kind of mistakes they made is so specific that you might as well just develop the thing in house since you clearly already have the experience.

Maybe what we need is a rules that any critical government infrastructure should be independently pen tested before it's bought. This should hopefully put off the inexperienced from taking on such projects and offer a way out for governments should the contract go sour.

I agree, this is often an issue. In my company a lot of people only make specs, and the "development" for a lot of components is outsourced. But these specs are basically developed already, so in the end, we're only making the expensive developers write a spec that's so detailed that it's more work to write the detailed spec, than if you programmed it directly from a non-detailed spec.

That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.