for better or worse, they are on the read-only partition, meaning removing them would change the checksum and result in the system partition failing signature validation at boot. Disabling is the best we will get as long as this practice continues.
I apologize for being blunt, but yours seems like a very lame technical excuse to justify existing behavior, at cost to customer experience. They could just as well put it somewhere where it's (1) still signed and (2) doesn't affect the signature of the base OS.