Not sure exactly what changed, but I believe changes to WinVerifyTrust have completely broken (at least) the disable fixlet.
I know I have ~1500 devices with it enabled, and up until yesterday (which also included WinVerifyTrust changes being pushed by HCL yesterday) I had ~1500 relevant for “disable”. Now, I only have 78 and it’s dropping lower.