There is no risk if you're genuinely running a small business.
If you're a permalancer, coining a freelance rate whilst paying very little tax (no PAYE), then you _should_ be caught out. You _should_ have the liability.
The problem is that the rules are ambiguous and in some industries (such as software development) it is not possible to effectively separate employees from contractors which means that even legitimate contracting activity can look like disguised employment.
If you operate a business that provides software development services and want to help a client with their existing software project (who already has full-time employees working on it) you will often need to become embedded within their team which includes participating in regular meetings (including daily standups) and do "employee-ish" things that look risky from an IR35 point of view. Just speccing out a clear scope of work in advance is very difficult as sometimes the scope will vary over time as edge-cases are discovered during development, so the SOW will end up very broad and may look employee-ish. Your best bet is to have mitigating factors such as working for multiple clients, using your own equipment, etc and possibly contract length (I am not sure if it counts, IMO it definitely should) but none of those are bulletproof either.
Contributing to an existing codebase in parallel with a client's in-house development team is risky from an IR35 point of view even if you are doing so in good faith and want to operate a business rather than just be a "permalancer". That's also why with the new rules (that are now being repealed), a lot of companies did a blanket determination of putting everyone "Inside" IR35 because the rules are not only unclear to begin with, but even more difficult to correctly interpret and apply in certain industries.
The spirit of the rules seems fairly clear even for software development. If you're being brought in to help with some specific project or to achieve some specific goal, you are doing that work autonomously and according to your own professional judgement, and you're otherwise operating as an independent business, you're not supposed to be caught by IR35. Obviously there will be some need for communication with other people who work for your client if the project or goal is part of the client's wider activities but that doesn't mean you're an employee.
Personally I'd get very nervous about the kind of contracting where you're expected to integrate with a client's Agile processes that have things like daily meetings and breaking tasks down to very small chunks where sometimes you get them and sometimes a permanent employee does and sometimes they move between you. That starts to look too much like a grey area even if everything else is set up like an independent business.
Maybe there should be some alternative status to support flexible temporary employees that reflects their closer involvement with a client/employer while they're working there but also makes allowances for the added risks and limited employee protections and the extra downtime they will probably have between gigs. It's obviously useful to have this kind of flexible labour force but it doesn't really make much sense to treat it the same as either running a truly independent business like a freelancer or being a full employee with the security and benefits that brings.
Edit: I'm thinking of a model where the rates and allowances work out the same as full-time permanent employment if you do end up working consistently but maybe the important figures get calculated over a whole tax year or can even be carried over across years to compensate for the unpredictability. Then you can probably let the market decide the rest of the pricing in terms of how much extra that flexibility is worth to clients and how much compensation is needed for the added risk to attract enough flexible workers.
It's funny that if the client decides to hire a big consultancy to do exactly the same thing, these rules do not apply.
The big consultancy gets paid an invoice, they pay their employee some salary and keep the profit.
If one man band business does the same thing, there is all sort of fuss about being a disguised employee and if the IR35 is applied, then they get taxed on the entire invoice.
To bring level playing field, these big consultancies should also be taxed on the invoice paid by the client, without being able to keep profit. If their workers were assessed for IR35, they would all be caught by it.
You're still liable for corporation & dividend tax. Though the rates are favourable towards the independent contractor, there isn't a huge amount of difference between a perm. employee these days; when you factor in the additional risk taken on by the independent contractor, it's difficult to say either way which one has the better deal.
We're not talking about someone who's doing better than you because they worked harder or had a better idea or took a useful risk that paid off. We're just talking about someone who paid less tax than everyone else in the same situation by using a trick that is potentially criminal tax evasion and getting away with it. Calling for any unintended loophole in the tax rules to be closed is hardly "spite" or "desiring punishment".
When IR35 was first introduced there were a significant number of people working through limited companies for the tax advantages who did enjoy much the same benefits as permanent employees. They had long notice periods to end contracts, they got to use staff facilities, etc. They were basically employees in all but name and that's why they were seen as dodging tax and IR35 was introduced.
The problem with IR35 has never been the principle that disguised employees should not escape the normal employee tax rules. It's always been that there were also significant numbers of other people affected who really were working more independently and acting like any other real business, which just happened to be owner-operated in their case. Even if they're doing nothing wrong all of these people now have this IR35-shaped sword hanging over every contract they take and so do their clients.
If nothing else it creates extra admin and more legal and insurance costs for those involved. I've known promising contracts to get sunk at the last minute because one side or the other was concerned about some of the details looking a bit too close to being caught by IR35 and because naturally these tend to be relatively short jobs it's not always worth engaging serious lawyers to resolve things. Basically it means everyone loses and all because the tax rules were ambiguous and created more risk than the contract was worth to either or both parties.
My experience contracting very many years ago (and before IR35) was that you were ultimately just a hired hand, compared to permanent employees, even if you were expected to turn up every day just like an employee, and your contract (which was usually only 3, 6 months) etc, would roll over and over as though you were permanent.
Sick days, no pay. Holidays, no pay. Economic downturn? You will be the first out the door. Contract not renewed? Tough, don't expect any 'severence'. Company makes a huge profit? No bonus for you. Forget billing for company parties/outings, etc. Training? lololol, up to you. Plus, you pay your own pension, social security taxes, etc.
If you operate a business that provides software development services and want to help a client with their existing software project (who already has full-time employees working on it) you will often need to become embedded within their team which includes participating in regular meetings (including daily standups) and do "employee-ish" things that look risky from an IR35 point of view. Just speccing out a clear scope of work in advance is very difficult as sometimes the scope will vary over time as edge-cases are discovered during development, so the SOW will end up very broad and may look employee-ish. Your best bet is to have mitigating factors such as working for multiple clients, using your own equipment, etc and possibly contract length (I am not sure if it counts, IMO it definitely should) but none of those are bulletproof either.
Contributing to an existing codebase in parallel with a client's in-house development team is risky from an IR35 point of view even if you are doing so in good faith and want to operate a business rather than just be a "permalancer". That's also why with the new rules (that are now being repealed), a lot of companies did a blanket determination of putting everyone "Inside" IR35 because the rules are not only unclear to begin with, but even more difficult to correctly interpret and apply in certain industries.