The vulnerability discovered by KYND is always disabled, so is it a risk?

Always being disabled is not a resolution to the issue.

If KYND can find it with an external scan, then it is externally visible on the internet. If it is visible, it is increasing your attack surface, even when disabled.

Threat actors look at the perimeter of an organisation's network to determine whether an organisation is worth attacking, and leaving ports open, even when disabled, may make you look like a target worth investigating further. 

KYND will always recommend closing open ports, or hiding them behind a firewall or VPN to prevent attracting the attention of potential threat actors.