You get a transaction id for your vote when you vote, and you can verify it against the open ballot. If they don't match, either the machine or the ballot was hacked.

The public ballot is much easier to secure, since you can just use a trustless ledger. Spinning up a ton of processing power to protect the voting process day-of elections isn't infeasible.

You allow people to observe the counting of votes and do exit polls (which is currently the case).