This came up as part of MDL-25718 which made is more obvious how to suspend a user's enrollment. When enrolments are suspended we're currently making no attempt to remove roles the user gained as part of that enrolment.
Note: recovery of role assignments is to be implemented as part of MDL-26907.