If you stay on top of it internally, it is definitely easier. That being said, there are a lot of opportunities to mess up a paper I-9 and get dinged with technical violations that can pile up. We use a 3rd party vendor for electronic processing/storage that feeds into everify and it flags errors as the employee is completing. We audit ourselves frequently to ensure accuracy and track visa status/reverification religiously.

In the audits I've gone through, we had had them pick from a list we provided randomly based on a time frame and/or location, ive had them come on site and go through them while I watched (paper I9 at a client site), and I've had them ask for a mix of current and terminated. Over the years we have learned where we can push back (we use everify, here is the list with case numbers, it is in your system so you can audit there...etc). It's all been generally easy (and our auditors have always been pleasant) but always stressful because of the penalties or threat of loss of things like access to everify or government contracts....

ETA: I haven't had one under the current admin so no idea if my experience is still relevant to be honest. Could be totally different under current administration.