Same here. One could argue that the scanning machine could still be a vulnerability, much like one could argue that anyone handling things in the counting process could also be a vulnerability. My take is that the proper requirements have been put in place so that those vulnerabilities are minimized. Better to only have to protect the scanner than to have to protect several to a dozen or so machines.