That does not explain at all "how to compromise a significant enough number of machines that never connect to the internet and whose firmware/code is audited by several parties and institutions before being compiled and installed on them", but I'll indulge you
- Brazilian urns are not "closed source". As I stated in other comments, the source is open, entities can audit it before and after elections and universities have permanent access to the code.
- The voting machines never connect to the internet. They don't even have a RJ45 slot.
- The "prove this has not been tampered with" is a possible problem, but given how the installation of the software happens, with human oversight of multiple parties, chances of that happening are reduced.
- For counting, after a check that everything went ok, the urns are locked and taken back to electoral tribunals, where the removable disks (USB) are read in a separate machine, which are then transmitted to the central processing system. There is a possibility of a "disk swipe" here and I don't know if there are any systems to check against that possibility.
- There is a possibility of MITM attacks during data transmission, but checking back whether the file was correctly received (checksum) is trivial. His worries are again on "a system no one but a very select few can see". This is not the case for the Brazilian system, all involved systems are audited before, during and after elections, including by political parties. It doesn't fix the "average person won't understand how it works" problem, tho.
- That Scottish case was funny for the fact that the result was a fucking spreadsheet
- I fully disagree with him that it's easier to cast doubt on electronic voting than paper voting, see that "pencil lead under the nail" trick for filling blank votes or nullifying otherwise valid votes.
- Voting from your own device is a stupid idea and thankfully it's not even being considered here
All in all, of the problems Tom raised, only 2 are really valid for Brazil (prove the installed system wasn't tampered with, prove there was no USB disk swipe) and both are dealt with with multi-party oversight, which is the same thing used to protect the validity of paper voting.