You're absolutely right but read the next line.

"While these vulnerabilities present risks that should be mitigated as soon as possible, CISA has no evidence that these vulnerabilities have been exploited in any elections.

Exploitation of these vulnerabilities would require physical access to individual ImageCast X devices, access to the Election Management System (EMS), or the ability to modify files before they are uploaded to ImageCast X devices."

Sounds like we need to get smart people to infiltrate and get:

1. physical access to individual Image cast X devices
2. access to the EMS
3. ability to modify files before they are uploaded