Ideally they are transported and kept under watch by many different parties with a stake in the result. Is the backup watched until it’s deemed no longer needed?

My understanding based on what I remember hearing a family member who works the polls explain is that they are locked up, then transported by the manager of that poll to presumably the county clerk who then takes possession of them and again they are kept under lock and key. These paper ballots also have to match up with a separate ledger of voters and signatures from that polling place, so even if someone added or subtracted ballots in between it would be identified. They would have to replace the ballot, which I believe is also numbered so they'd have to also forge an identical ballot of the correct ballot number to replace it with.

All the different parties should be watching out for errors, a human error should be difficult to happen

My understanding of the process is they'll have two teams of people repeating eachother's work on sets of 50 ballots, verifying the ballot matches the ledger tallying the votes then check if their counts match for every batch of 50, if the two teams counts do not match they recount the batch of 50 until the two teams counts match. So miscounting and not catching it is difficult, but if you've got 200,000 ballots and you assume an error rate of 1/10000 that's potentially 200 votes that might flip due to pure human error. It's a roll of the dice for the candidate, but if you lost a key county by 75 votes then you've got decent odds of the recount changing the outcome of that county election