The only way that Southampton can be disqualified from the playoffs element is if they gained an advantage.
No one can prove they did.
So the only punishment can only be a fine and if they stay in the EFL a points deduction.
It doesn’t matter if the spy was an employee or not, Southampton have admitted the charge.
If evidence is found that they used spying on other clubs outside of the rules, then there might be a case for disqualification for reaching the playoffs using illegal means. But not in the Boro case. Any possible advantage was negated by the discovery before the final day of training.
I am not defending Southampton, just stating what is obvious to me.