This is working as designed some face it differently based on app assignments (Link to olhttps://devforum.okta.com/t/scim-group-push-includes-disabled-users/31389/2?u=krishnad posts), you may require a feature flag to be enabled on your tenant (Chances are low that this can be changed.) if you want to change this behaviour and this upstream in Okta, as its the default hard coded behaviour based on what we know.
Fix is on your side which is recommended.
Make sure the remove the user from the group first and then proceed with deactivation → Do this always.
Handle stale membership defensively: cross-check active on PUT /Users against any group membership state in PUT /Groups. (Don’t trust put + deactivations, gather more signals before hand.)
Let us know how it goes?