If they don't keep track of which matches are false positives, wouldn't it be possible to be extremely unlucky and pass the threshold with nothing but false positives generated by Apple?

This makes things worse not better.

No, the vouchers attached to the fake positives do not provide information for decrypting the images

So then it is possible to determine which vouchers are real and which are fake, and a court can still order a query for everyone with N-1 hits.

Thanks, I missed that paragraph.