Incorrect. You can combine a personal secret code with the output of the vote-teller in order to determine who you voted for. The vote-teller would have no way of determining who you actually voted for without your personal code. Even more secure would be to have two personal codes, one a "real" code, which outputs the actual candidate you voted for, and one "duress" code, which outputs a candidate you didn't vote for(in case someone is holding a gun to your head to confirm you voted for their candidate)
Wouldn't the person with the gun just demand both codes? And typically a ballot has multiple offices to elect. Would you flip all of them for the "duress" code? It seems like it gets complicated really quickly.