> having the voting source code public and auditable seems like a good way to build trust

It's not the source code that matters. It's the whole architecture, design, supply chain, and implementation as in down to object code _including_ firmware.