There have been efforts to do this in the past. DEF CON's Voting Village spent a lot of effort to get second hand voting machines and provide them for hackers to try to compromise. The voting machine companies hated it, because it often demonstrated pretty terrible security practices. Since fixing security is expensive, they often adopted a "security through obscurity" mindset and refused to have anything tested. DEF CON still has a Voting Village, though I'm not sure if they still offer up machines for direct attack. Though ya, why States are satisfied with machines which don't come with some type of standardized testing (including Red Teaming) is beyond me. The AVS WinVote's security was so atrociously bad that it was finally decertified in a lot of States.

That said, hacking individual voting machines would be of little use if your goal is to change the outcome of an election, especially Statewide races. Polling in the US is really distributed, meaning that any effective attack would need to have multiple people all working in concert. And hacking on a machine by machine basis would take time and possibly create a lot of noise (statistical anomalies and the like). Big shifts would really come from pre-election tampering with things like voter rolls and propaganda/influence campaigns. That's where CISA could (or should have) helped. Showing up now is way too little too late. It's just the Trump administration trying to build up a bullshit case of "those silly States didn't let us help them. Now look at how badly they were all HACKED!" With, of course, Democrat wins being the only "proof" of said hacks.