Simple analog fix. Prior to leaving the machine a row of holes is punched at the bottom of the ballot.

There's easy ways around that even on a very small, very simple system - output a log of all ballot serial numbers scanned in the batch along with the batch tally.

For extra assurance, sign all the output data with a machine-unique private key to ensure it can't be tampered with upstream in the processing chain. Signature bad on a batch -> reject all ballots from that machine and send it off for forensic analysis. Validated crypto engines are available even on very simple platforms now, so this doesn't conflict with low-complexity hardware.

They don't even need to do that. They can just insert a thumb drive and upload a fake database of ballots as if they were scanned, without ever scanning a single ballot, or scan real ballots as normal then upload from a thumb drive to replace the ballot database with a fake one made months ago. Then after the election is over, they erase everything and go into the physical ballot storage and switch hand made fraud ballots in for the next week after the election, so even a recount wouldn't show anything.