But that's not the truth though. Open source software is not easy to tweak when it's deterministically compiled using reproducible builds and there are provisions for on-demand inspection of executables and hardware.
Firstly, inspection of code is a very technical skill, so there's a certain amount of reliance on a tiny group here. That tiny group then simply declares whatever they like. Understanding a complex C program, looking for obfuscated behavior is a very specific skill.
Secondly, given the tens of thousands of machines in play it becomes impossible to guarantee the code inspected is the code that runs. The GCC compiler itself, used to build the software could be altered. The kernel of the machine could be altered, and so on.
Yes, ultimately given enough time, it would be possible to detect problems. But getting a report years after the election is fruitless. Also, no doubt, with time, security issues in the OS and code will be retroactively discovered. There will be no way to determine if those flaws were used or not.
In short, you cannot determine veracity or correctness of the machine, in reasonable time. Making the code Open Source does not change this.
And again, it doesn't matter if the code is honest or not. It only matters what people believe. If anything having the code Open just means more opportunity for malicious actors to claim they've "found issues" without being specific.
The issue is not the software. And its not the software license. It's the environment of mistrust coupled with the willingness of people to accept obvious and blatant misinformation. (See vaccines etc).
Don't put all eggs into a single basket.
Independent testing laboratories exist that do specialize in the specific skills you're talking about. Pretty much all of the software involved is certified and saved, source is saved, compiled binaries are saved, hashes are logged of the compiled binaries. Binaries run from EPROMS or write-protected partitions making it very difficult to change them once installed. Cabinets have tamper-apparent sealing.
The machines are designed so that an auditor can inspect a machine on a casino floor in under 5 minutes, verifying that the software that's installed is the one that's supposed to be and that the physical seals haven't been broken.
I'd imagine there are a lot of similar processes for ATMs.