Hey Kevin,
Good find. I'm running 15.0.5949 and see this behavior as well. The same is true when POP Retrieval is enabled but IMAP is not -- you're still able to create an IMAP connection.
That being said, I may be able to offer you a work around until this is fixed. It appears that if you enable both IMAP and POP for the domain, but disable one of them for the specific user, the restriction is honored and they won't have access to the disabled option. (If you have many users that require this change, be sure to utilize the Domain and User defaults found when logged in as the System Admin)
Hope this helps! And thanks for the report.