This applies to multiple modules but one example is Tags. If I disable Tags for a user, it only prevents them from seeing and managing Tags in the Settings. They can still assign tags to contacts (as they should) but they can also CREATE new tags. Many automations are tag-based so creating new tags will consequently break automations. See Loom for demonstration of this.