That threat has existed as long as mail in voting has existed. It's not a serious threat based on history, and the ballot are tracked, they are secure, have individual bar codes for scanning, are tied to a single voter. It's not like they're printing up a bunch of blank ballots and sending copies through the mail. When you return it the envelope in which you insert the ballot is tied to ONE person. You sign it and election people match the signature to yours which is on file. Then it's counted.
It's the same issue with impersonation fraud at the polls. For a long time we needed minimal ID to vote. Well, in theory someone could look at a list of registered voters, and impersonate them. We know that doesn't happen because if it did, lots of those people would show up and workers tell them, "Hey, you voted last week!" but that NEVER happens. So now we have strict ID to address a problem that didn't exist in reality, but did exist in the minds of people looking for an excuse to force strict IDs.
Finally, as always, this kind of fraud cannot be relied on by people to swing elections. A few dozen votes doesn't get anyone there. It takes at least thousands and in most cases tens of thousands. So you'd have people committing massive numbers of felonies, hoping they're not caught, for a trivial chance of changing the outcome. That doesn't happen in real life. There are no busses taking people across state lines. So the real fraud we should all worry about is done by insiders, guys making $1,000/hour in consulting fees, etc. If you control the count, you control the outcome. If you control the voting lists, you can control the outcome. If you can make 8 hour lines in a city, you can force thousands to not vote, do that in enough cities and you change an outcome. Etc.
