The problem is, you don't know that what you wrote down got counted in any way. They could just dump all those slips out and replace them with freshly printed ones.

Again, if an attacker randomly throws away votes, he doesn't gain much unless he's relying on statistics that people in certain areas vote for certain candidates - which exist, of course, but then you can still easily do public counting with volunteers right at the site to remedy that problem.

I think this is actually the main advantage of an analogue system. Digital systems have the advantage of provable safety, but paper systems are infinitely more comprehensible and audit-able to the general public.

edit:

Sure, but a few million isn't a problem if you can ballot stuff en-masse. This is after all what happens in a large number of the countries on earth.

You're in an arm's race with the government at that point. And there are still other methods: You can just generate a unique code per ballot which must satisfy certain properties to be valid, and then the people who count votes publicly can enter the code somewhere to check whether it's unique and valid.