the opportunity to recount is not itself an adequate protection for an online counting machine. in my county for example, recounts are only triggered for close elections. they do zero auditing for normal wins.

The system needs to be secure in the primary case, not only in the audit case.

Now if you're saying the counting machine is offline, so that it's verified during the normal voting process, that would be more acceptable.