Once the company sells the voting machine to some state or city I would assume the voting machine is not "owned" by the company anymore. I'm also assuming they aren't in any way connected to a network and are all isolated independent systems.

The state should be auditing them prior to using them to see that they work as expected.