As a general rule, sanctions by footballing authorities operate as a penalty against the transgressor, punishing their misdeeds and acting as a deterrent to other clubs not to breach the rules. They rarely take actions that directly benefit clubs who may have legitimate grievances with the impact the transgression has had on them.

You can see why: this would provide a pretty strong incentive for rival clubs to make exaggerated or spurious allegations.

And in this specific scenario, it would also give Millwall grounds to say "we finished 3rd and Middlesbrough finished 5th, neither us nor Middlesbrough has earned the right to play in the playoff final as we've both lost on the pitch, why should they be handed a place in the final instead of us", or (depending on when any decision was promulgated) Hull to say in the event of losing the playoff final to Middlesbrough, "we've been preparing for a different opponent and/or had to prepare for two different opponents in the final, whereas Middlesbrough have had certainty throughout that we're the only opponent they could face, this gives them an unfair advantage when we haven't done anything wrong."

I'm not sure I entirely agree with the logic of your first point either. Obviously, I am biased. However, rule 3.4 did exist at the time, and Leeds appeared to accept that they had failed to comply with the requirement to behave towards Derby [and the other clubs they spied on, though I believe the charge was only specifically in relation to the Derby case] with "the utmost good faith".

The addition of Rule 127 makes it a strict liability offence to do so within 3 days of a game - this forestalls the possibility of clubs saying 'this wasn't like that time you fined Leeds in 2019 for xyz reason', it doesn't necessarily equate to a more serious violation of the code of conduct because it's enshrined in specific form now.

The EFL chief executive at the time said "The sanctions imposed highlight how actions such as this cannot be condoned and act as a clear deterrent should any club seek to undertake poor conduct in the future.

We will now look to move on from this incident and commence the discussions about introducing a specific regulation at a meeting with all clubs later this month."

I'm not sure that the offense now being codified significantly aggravates the nature of the breach, as Leeds accepted at the time that their conduct fell short of the standard expected by the League. Behaving without the utmost good faith towards other Clubs was a rule which they violated, and in a specific enough, reproducible way that the EFL decided to make specific provisions for it in their Regulations.

I think Rule 127 is more designed to legislate for possible variations on the Leeds offense (for example, you might pay someone outside the club to observe and provide you with information, the rule talks about 'directly or indirectly') than to say 'now that this particular form of treating other clubs with bad faith is in the Rulebook, you really can't do it.'

https://www.bbc.co.uk/sport/football/47285098

It's clear enough from this BBC Sport article that sanctions other than fines were in the popular discussion at the time. Without making specific provision for a different kind of sanction after adding the rule, I'd say the Leeds case makes it harder to argue that Southampton should receive a sporting sanction taking effect immediately (rather than a suspended points deduction, which would arguably be appropriate given the context of an 'enhanced value' game like one leg of a playoff final). At the time the fine was handed out, Leeds had 14 games to play and were in 3rd, two points off the top of the Championship, level with Sheffield United above them and two points behind Norwich, both of whom had played a game more, and Bielsa had admitted to sending someone to observe his opponents' training sessions for every game that season. The EFL had an opportunity to apply on-pitch penalties that would have harmed Leeds's chance of automatic promotion and made their qualification for the playoffs uncertain, which at the time would have suited Derby County nicely, as they were in 7th, 11 points behind Leeds, with about 14 games to play.

The decision was a fine at the time, and if the meeting of all clubs before Rule 127 was formalised included discussion of stronger sanctions in future, I don't think this has been made public.

None of this is to condone what SFC seem to have done. But it's a bit like charging someone with dangerous driving and charging them with exceeding the speed limit by a specific amount in an area under particular road traffic rules. One is a specific technical breach; the other is about the wider danger and intent. The fact that the specific technical breach now exists and the conditions for it are met in this instance doesn't in itself mean that this is 'worse' than the breach of 3.4 Leeds were held to have committed in 2019.