The realistic worst case is losing web app market access
When EA does act on transfer market automation, the usual outcome is a block on using the transfer market through the web and companion apps. Your club, your coins and your players stay where they are, and you can still play and trade in game. It is annoying rather than fatal, and some users shrug and carry on with a second account.
Full account bans come from a different kind of behaviour
The bans people actually lose accounts over are for buying coins from sellers, sharing account details, and shifting coins between accounts through deliberate loss-making transfers. An autobuyer running in your own session is not that, which is exactly why nobody is asked for their EA login.
Most punishments trace back to ignoring the safety rules
Sniping for fourteen hours straight with no breaks, running thousands of searches in an hour, or overriding the blocks is what puts you in the unlucky 2%. The rules exist because reported cases were read, patterns were found, and the rules were written from them.
A punishment expires with the game
Where a market restriction is applied, it lasts until the next title arrives rather than permanently. That is the practical shape of the downside: temporary loss of one interface, against a market you can work every day of the cycle.
The software is opinionated so you cannot be careless
Safety blocks refuse actions that look automated, search delays are randomised, breaks are built in, and daily search and snipe counters are in front of you. You have to work to defeat those, and the point of them is that you should not.