Azure Routing Between Private VM and Network Restricted Storage Account Works Despite Service Endpoint Being Deleted and Disabled

Question

To replicate:

1. Attached the Microsoft.Storage service endpoint to the VNet running the private VM
2. Restricted public network access to my VNet and subnet on the storage account using the service endpoint
3. Confirmed that the effective routes for my private VM's VNIC show the effective routes to the Microsoft.Storage endpoint
4. Tested with curl from my private VM to a blob in my storage account and got a 200 and was able to fetch the object
5. Confirmed that storage account logs show called IP as the private IP of my VM.
6. Deleted the service endpoint from the VNet section
7. Service endpoint status on storage account shows as disabled
8. Confirmed that effective routes to Microsoft.Storage CIDR ranges are removed from the private VM's VNIC.
9. Curl is still successful to the storage account, even hours later.
10. Logs still show called IP as the private IP of my VM.

If the service endpoint is removed from my VNet, showing as disabled on the storage account, and the effective routes are removed from my VNIC, how is routing still successful?

This seems like a bit of a security and observability gap.