> Aren't the ballots all counted by hand and then cross checked with the machines anyways?

I believe some states completely hand recounted the entire millions of receipts from the machines this year (in response to the allegations of voter fraud). However, it shouldn't be necessary to exhaustively recount the entire race. We should be able to use random sampling to statistically verify that the race is not fixed.

probably not fixed.

Sure. I mean, a clever enough fix is unavoidable. Like, suppose I swapped out all the machinery with duplicates that had different vote counts but matching ballots. If a back room was cranking them out in parallel, the total votes cast and even timestamps (if there are any) would match.

But we can set the confidence we want and test enough ballots to get there. In this past election, some states decided it was "100% sure to this kind of detectable attack" and they hand counted every ballot.