It really can't. What is the mechanism by which it could? Different states use different machines and each individual machine is airgapped. A general supply chain attack would show up in statistical sampling audits (i e. hand recounts of small numbers of ballots, which we already do).