We had an issue today where a customer placed an order to an address for which we turned off the state. At our store we turned off US Army PO Boxes temporarily, but our customer had an Army PO box address saved in his user account from when it was turned on, so our website let him check out.

I think this works correctly for countries (i.e., if you turn off India, and a customer has a saved address in India, the cart will not let you select the address during checkout). It just seems the cart doesn't do this check for states.