> How? Any possible scheme I can think of that could theoretically allow a tabulation machine to behave differently on audit ballots than it does on real ballots, can also theoretically be mitigated via audit procedures.

An audit will only mitigate that if a) you have paper ballots you can check, b) the audit happens very soon after the closing of the polls. If an audit takes place a month later, that's a lot of time for the elections administration to create all new ballots to replace the originals with, so the audit has to come very soon after the election.