I assume they're talking about what happened after they turned the machines and ballots over. Nobody knows who all had contact with them, much less custody of them.
That statement is false. During the audit the location and who had access to the machines has been well documented.
Moreover, it should not matter. Voting machines which are certified by the US government must pass tests that determine if all of the software present on the machines is exactly the same as the software provided to the US government approved testing lab.