Poll workers (or someone posing as a poll worker) could easily do this and it wouldn't be noticed as suspicious because poll workers are naturally assumed to be allowed to interact with the poll machines.
"What are you doing there?"
"Oh, just updating the firmware to protect against a new zero-day threat."
There is also variance in where you vote what machine they might have. My location has always been a scantron type and only one device per voting location. You'd have to know ahead of time what device is used where and have the correct exploit handy. Still in my scenario going to be hard to pull off an exploit while people are waiting to enter their ballots into the machine.
Not saying it couldn't be done but I'd say it is out there for a probable attack. They do make for good headlines and of course are something no one wants to see tampered with. I'm glad the one's in my district still have a paper trail, which has been used in the past to verify votes by hand when the election was close.
In reading the headline I was expecting they would explain it within the first few paragraphs but instead buried what the kid did in the last 5 sentences of the article.
Like most of us though still alarms me that these machines are in use and have some easily exploitable vulnerabilities but as mentioned by one of the vendors in the article some/most of these exploits require physical access to the voting machine. Not to take way from the exploits but it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day.