Issue
When deploying Profiles, you may notice that user permissions disabled in the source org remain enabled in the destination org after deployment.
Cause
The Salesforce Metadata API excludes disabled user permissions (those set to false) from the retrieved profile XML files. This is standard behavior of the Metadata API. Consequently, when you retrieve a profile using Change Sets, Workbench, the ANT Migration Tool, or Salesforce CLI, only enabled user permissions (those set to true) are included.
As a result, when deploying Profiles, only enabled user permissions are deployed to the target org.
Note that this Metadata API limitation is only applied to user permissions. For other non user permissions - such as app visibility, tab visibility, object, fields level security - the Metadata API will retrieve both enabled and disabled permissions as long as you include the apps or objects in the component selected list.