Not really an easy attack but still a possible one, and these machines have not established a strong reputation for protection against something like a firmware implant
This state uses and retains paper ballots, so it would be yet more difficult to design an attack that would withstand an audit of the paper ballots. But some states don't...
An electronic voting machine could be tampered with well ahead of voting day. Verification hashes and the like are only aggregates that are open to trickery on the way to the humans checking them, the ground truth is impossible for a human to process. We cannot sense the state of a computer without its help. In contrast to this, the initial emptiness of a physical ballot box is very much in the realm of human senses, it's perfectly safe to leave them unattended until voting starts.