In practice too. Elections are worth up to trillions of dollars. That means that agencies like state-level actors, and private actors with the necessary resources, will be tempted to mount supply chain and other attacks, and likely will succeed.

Faking paper ballots is totally doable, but you can take various precautions to make that very difficult. For example, you can deliver ballots to polling locations in sequentially-numbered packs and shuffle them at the voter sign-in desk: by shuffling the packs before delivery, by having the elections judges record which packs they got and which numbers went unused, by making them sign ballots prior to placing them on the sign-in table, and so on, you can make it very difficult for elections administration staff to later replace those paper ballots. But you're going to need timely, partial or full hand-count audits in order to make it necessary to replace paper ballots in order to replace results.

Election security is pretty expensive, but compared to the _value_ of elections, it's nothing.