This came up as part of MDL-25718 (PULL-421)

Comment from Petr:
When disabling enrolments it might be better to also offer option to remove all roles because if we keep the roles and course allows guest access the students could still get in with all their original rights.

I think this is a major issue that would have to be addressed soon, it would probably require changes in UI and new language strings.