First of all, I don't like to use the term "address a risk" because there are more accurate words than "address". I know it's a commonly used term in risk management but I feel it is likely to be misunderstood so I would rather avoid it.
Anyway, there is no security risk that removing a disabled account addresses. However, I believe you are asking the wrong question.
It depends on what you mean by "a disabled account".
A disabled account could be as simple as a row in a database with 2 columns, a primary key userid which is an integer, and an enum isdisabled which is set to "TRUE". Does deleting this disabled account address a risk? I don't think it does.
But on the other end of the spectrum the disabled account could contain credit card numbers, unencrypted passwords, photo of driver license, social security number, etc, along with isdisabled set to "TRUE".
What exactly is a "disabled account" in your scenario?
In general, I would recommend to never delete disabled accounts, and rather consider removing sensitive information at the point of "disabling" the account. So if a user disables and then reactivates their account, they will need to add card numbers again, re-verify their phone number, etc etc. So basically setting all flags to their default positions and keeping only non-sensitive information.
Keeping disabled accounts has value. You have a hard record of how many users have ever signed up, and you may consider to keep some of their information for various purposes. If a user signs up, verifies their phone number, then becomes blacklisted/banned by your system, then deactivates their account (and your "disabling" system either removes their phone number or removes their whole row including phone number), then they can sign up again with another email address and re-activate their phone number and potentially get around the blacklist (if your blacklist is a column isbanned).
So definitely keep your disabled accounts, just make sure to consider removing sensitive information from them, especially the kind of information users would expect you to delete that you can't possibly use for good purposes.