I looked into the details, and the table is never "attached" if it's disabled: https://github.com/facebook/osquery/blob/master/osquery/sql/virtual_table.cpp#L591-L594