Hey!
A user can be disabled for multiple reasons:
a) Doesn't belong to the security group associated with the domain.
b) M365/AzureAD setting to prevent login
c) If the company is using Pivilege Identity Management and the access is lost
d) If the user doesn't have ANY license that allows access.
e) Plugins/workflows requiring specific fields to be populated might also set the enabled/disabled status.
As you indicate, this is an automatic value set on user sync from AzureAD/M365 portal. When a user is disabled it means that:
a) the user can't login.
b) records are still associated and you can create reports based on this
c) any Workflow/SDK processing step running under the context of this user will stop working
A user that doesn't have security roles, can get security roles assigned through a Team (and therefore, login).