I believe the Paperclip Rails plugin was only used in the Washington DC situation. I wouldn't call it sloppy to use a 3rd party plugin, in many cases, that is actually much better than a "roll your own" solution. Rather, I think the sloppiness here stems from the fact that the exploit in Paperclip had actually been documented previously so the developers should have performed filtering which would have prevented shell injection in file uploads. It does seem that overall the developers could have done a much better job, but it's also very difficult to build such a piece of software without a massive team and constant testing with realistic deployment (mostly due to the security requirement, any unaccounted for vulnerability could lead to the downfall of an entire election).
To quickly comment on the other paper, it seems that it is just as much a political commentary as a case study on EVMs (electronic voting machines). It appears likely that a corrupt government may have intentionally made the voting system "hackable" so that elections could be manipulated.
