I suspect this is not the full story. Why would someone waste their time manually disabling a device? That makes me think that this device was doing something malicous to their servers, enough to trip an alert.

Might just be a "could not contact server for X days in a row" thing.

Not really. They probably flagged this as someone modifying the device and thought it could be someone reverse engineering it.