This API call to the Apps endpoint doesn’t return Users, it returns Application Users, a distinction that explains why the status found in the Application User doesn’t match the one in the User. Seeing ACTIVE for these users is expected behaviour, provided the user is assigned and confirmed by the application.
There’s more info about what these statuses mean in the Apps documentation.