They are using paper ballots. GA for example has since 2020. Several methods of auditing the counts of paper ballots require some tabular record of the contents of the ballots (so that it's practical to perform risk limiting audits on random samples), and the problem here originates from the process by which that tabular record is produced and the way it is made public. The same problem could exist in a hand counting process with risk limiting audits.