You are right. The UI shows Siri disabled and offers to turn it on, but the process is still running. That process seems to change its name based on whether the UI thinks Siri is enabled; it can be called either just "Siri" or "Siri AI" but it’s the same executable.