The problems do look the same. Why don't they share a common enforcement agency? Because they deal with two types of entities (government vs corporation) that operate machines with vastly different use cases with vastly different threat models. A casino's threat model for its slot machine supply chain is completely different than the threat model for voting machine integrity.

Boiling the problem down to the integrity of the hardware and software throws out the nuance of how and why exploitation might occur (and who is doing the exploiting), which has huge implications for how you make regulations and do enforcement.