My concern would be in proving that the envelope you didn't open is the same one that made it into the final count. If you have no more connection with it after you leave the booth, you can not verify that the letter wasn't tampered with (and also no one can coerce you into showing who you voted for). Any way that lets you verify that the last envelope wasn't tampered with would also let some third party see who you voted for.
Anything the machine electronically presents you with can be modified on a compromised machine, while physical printout that can be used later to verify will either be unable to prove that your vote wasn't switched (though it can prove that your vote was counted) or it will be able to prove you did vote for who you choose, the latter case meaning that a third party can then use this to know who you voted for.
You're attacking the parts of the analogy that don't apply to the actual cryptography. Best way to see how they get around the issue you're talking about is to watch the video.
Anything the machine electronically presents you with can be modified on a compromised machine, while physical printout that can be used later to verify will either be unable to prove that your vote wasn't switched (though it can prove that your vote was counted) or it will be able to prove you did vote for who you choose, the latter case meaning that a third party can then use this to know who you voted for.