Firewall status: "disabled" or "disabled by policy"... strange behaviour

SEP 12.1 RU2.

I've one group where I've withdrawn the firewall policy (component installed but policy withdrawn).

I don't understand why I see, in that group, some clients with the firewall status reported as "disabled by policy" and others reported as "disabled".

All those client rebooted after the installation, they have the correct (and the same) policy serial number, same OS type, they had not SEP before so no old communication settings and so on... simply I don't understand.

Any idea?

Thanks!