Correct, but there are always telltale traces on the hard drive which are susceptible to forensic analysis.
Many, many child porn offenders are in prison because they thought they had used state-of-the-art overwriting software to wipe their hard drives, but federal hardware experts were able to reconstruct images that had been wiped in binary several hundred times.
And you cannot wipe a defrauded election machine drive even once, because you will erase the fake votes along with the virus. You basically have to hope that no one suspects anything fishy, because once there's an investigation, you're toast.
It's even easier to find the culprit because, as you say, a single person can pull this off and the chain of custody is a matter of record.
The Diebold machines use flash memory, no hard drives.