Why are disabled accounts synchronized to AAD

I used the Azure AD Connector to set up WAAD Synchronization.

I used the defaults.  Everything seemed to work fine.

After synchronization I see that all of my AD disabled accounts exist in WAAD.

Based on the default rules setup particularly the "In from AD - User AccountEnabled" rule I wouldn't have expected this.  Can someone explain to me why this is?  And how to remove disabled user accounts from WAAD synchronization.

Thanks!