I don't know why the "disable" doesn't work ... I don't have a test account to try.

Maybe someone more knowledgeable can answer ?

What do you mean by unexpected lockouts making the DENY dangerous ?