Well, I'd argue pen, paper, hand count, not pencil, but your point still holds.
Pens in voting booths run out without showing an obvious external sign, you have to test them continuously, one at a time, for the whole day. Pencils in booths can be easily checked by sight at walking pace whether they are blunt without touching them. Much quicker. Also pencils tips don't dry out.
Your concern, I'm guessing, is someone rubbing out the pencil and changing other people's vote? Soft graphite on thin cheap matte paper can't be easily erased without leaving marks or ripping the paper. The marks allow counters/auditors to see changes made to the ballot. A few corrections might be ignored, a thousand ballots in the same ballot box all with the same "correction" either means fraud or a huge design flaw on the ballot. Either way, it's a big red flag.
[I recall reading that the AEC actually chooses their paper & pencil brands specifically for this property.]
Likewise, graphite is just black carbon, it's pretty inert unless you set fire to it. OTOH, many organic inks can be erased with certain basic solvents that otherwise leave the paper unharmed, and metallic inks are never used in cheap pens. In theory you could spray the right fast-drying solvent on each ballot, then re-mark them when they are dry. (More convoluted hence less likely than basic ballot stuffing, but if it's a concern, pens are not the answer.)
I'd also thought about electronic means that generate a paper receipt, but there's still no real guarantee that the machine tabulated the vote correctly or that the voter will have recourse if the receipt shows something other than what the voter intended.
If you are willing to give up the non-sellable/forcible vote, there are one-way functions that can generate keys for tracking ballots. Ie, the voter gets a receipt with a number that enables them to later check their vote online. The key function can't be reversed, so the Ruling Party stooges can't pull up all the votes for Rival Party candidate to to unmask those voters. Indeed, even the personal key isn't linked to the voter's ID, except on the piece of paper held by the voter.
[And therein lies the flaw. It is possible for people to be individually coerced into logging in and showing their vote to Party loyalists. Say by bosses or union heavies. This sort of thing apparently happens in Russia a lot (except using postal ballots), along with the more usual voter intimidation and fraud. Or more peacefully, it allows people to buy votes. "Show me your vote, if it's for Rich Party, win $50".]
Such a system would also allow "floating proxies". A system where you assign your one-vote to a proxy (who either uses it or assigns it to a further proxy) and proxies vote in Parliament/Congress in proportion to the number of votes assigned to each of them. Unlike current representatives, you could reassign your vote as often as you want (hence "floating"), and, unlike current representatives, no voter is unrepresented (because there's no "winning" or "losing" candidates, only proxies.)
[This still has the same flaw. Someone can force you to surrender your key so they can manipulate your proxy.]
Hence my support for optical scan with the ability to hand-count.
Not disagreeing with that part. Except that the hand count should be the "official" count, and the optical scan just the election-night "indicator".