In terms of security, that is probably exactly correct (I'm a complete security novice FWIW). Way too high of an attack surface area. That being said, as soon as you get into microcontroller territory, you turn it into a niche thing that makes it inaccessible to most. What are the chances of finding talent that can write user-facing code that runs bug free on microcontrollers while simultaneously writing/proving the crypto? Maybe that talent is more common than I suspect, but I certainly haven't seen it. I would be happy with rust/ocaml on a unikernel or rump kernel though :)

This is my reaction too. There are systems with no security flaws, but they tend to be small-surface devoted hardware. Something the size of Windows will consistently turn up zero-day flaws that could be used against voting, whereas plenty of on-metal microcontroller programs have no holes at all.

Frankly, a really reassuring voting system would be the exact opposite of what we have: it would be open to all security researchers and consist of minimal, verifiably-safe code to count vote totals.