The way `Apply` works, it will only explicitly [*Enable* units](https://github.com/coreos/coreos-cloudinit/blob/master/initialize/config.go#L255). Locksmith has never had different behaviour (c.f. [here](https://github.com/coreos/coreos-cloudinit/blob/9f38792d43185f6593381a80c037e32cb60d5ebc/initialize/locksmith.go#L64))

The *Mask* functionality (which might be what you're thinking of?) is a separate codepath, and functional, except it has a longstanding bug of its own - see #122