There are a good number of cowboy operators still out there, though they 'cowboy' antics are now quite different to previous times. I can go through most counties now though and find at least 1 standout cowboy operator who I would categorise as fitting into the cowboy category very nicely.
These days I'd argue there can be more things that you can get away with as enforcement feels like it has reduced.
One operator in Staffordshire regularly operates services not in line with the registration by operating early (more than the 1 minute early that the TC allows), on last trips of the day often terminates early then heads home rather than finishing the run, regularly provides buses which aren't in line with the council specification. Same operator can also be found running local bus services on a 30 minute round trip, with only 1 single timing point (to comply with the regulations that there should be a timing point every 15 minutes) so that if a traffic commissioner comes knocking, they can avoid being caught out for early running despite some buses in the morning arriving at the terminus 10 minutes early. The lack of timing points also means that drivers can (and do) go whatever way they want, some go through the estates, some don't. Because there is no timing point, passengers nor drivers know which way the bus is meant to go so is unlikely to raise it as an issue. Operator then refuses to comply properly with Bus Open Data regulations and provide full and correct data so then any passengers are unlikely to know when their bus is due either due to poor journey planning results.
That's an awful lot for 1 operator to be doing wrong. Yet multiple councils issue them with contracts.
Whenever contract breaches are raised with councils, the council sits back and says 'we will take it up with them' or 'nothing we can do', 'Live tracking is inconclusive even if the tracking shows the bus at 30 second intervals going back to the depot and not completing the trip' or the blinder that I love, 'it's deregulations fault' (yes, these are all genuine responses from local authorities when issues with tender compliance are raised), all because councils don't want to act upon the issues. Therefore bad operators get worse and worse because the Traffic Commissioner doesn't sort things which are within their remit. The councils don't want to/can't be bothered to act on the breaches despite having punishment clauses in the contract, they don't want to action these because when the route goes out to retender, they don't want to pay more. So they prefer a poor operator running a substandard service, rather than paying more for a good job well done. If there is no punishment, bad operators get worse. Sadly only Derbyshire Council has the backbone to pull contracts lately, and even then that was after a stupid amount of none compliance.
Another example that is becoming more and more prevalent over the past few years is cowboy operator upto dodgy things in terms of the vehicles. There are a good few cowboy operators who operate buses have no legal address lettering on the side of the bus, or deliberately trying to obscure it by using black letters on a very dark blue livery, not 'colour contrasting', or using letters which are certainly not 25milimetres tall as per COIF regulation 45 (
https://www.legislation.gov.uk/uksi/1981/257/regulation/45/made). To be 25mm tall, that means that they would be bigger than a 20 pence piece, most of these would be covered by a 5p, let alone 20p.
On Rail Replacement, there seems to be a growing amount of people driving without a tachograph when the route would fall into scope. Having lots of drivers who aren't trained on the vehicles that they are driving and thus per DVSAs walkaround checklist, drivers can't possibly have completed the walkaround (Which states drivers should ensure is in good condition, and know how to work all accessibility equipment). Wheelchair lifts not working, drivers not trained on it's use, lack of wheelchair straps etc. One such event a month ago, 8 consecutive coaches were not fully PSVAR compliant despite claiming that they were and no PSVAR exemption certificates. This ranged from lack of training, to lifts not working, to no wheelchair straps etc. Growing numbers of cowboy operators who are not sorting out seatbelts which don't retract properly... These are coaches carrying school kids and yet safety is compromised with seatbelts which don't work.
I've given a few different situations here but in short, while I don't think that the cowboy antics of the past are still around as much, there is still a lot of operators who are ignoring laws or just blatantly operating unsafe buses in some way. Anyone who has any power to stop it, won't, so the operators keep doing it.