Why is disabling a leaving employee's Windows account not enough once certificate-based authentication is in use?

The certificate works independently of the account: it stays valid until it expires (typically a year), so it must be revoked as well.

A web server doing TLS client authentication checks the certificate: is it signed by a trusted CA, is it within its validity period, is it revoked? It does not ask Active Directory whether the account behind it is still enabled. A former employee who keeps a copy of their certificate and private key (exported, or on a device they still have) could therefore keep logging in to the intranet for up to a year after their account was disabled.

The offboarding process therefore has to include revoking the person's certificates at the CA, and the server has to actually check revocation, through a CRL or OCSP. Without that check, revocation achieves nothing.

The same reasoning applies to every certificate-based access path: VPN, Wi-Fi with 802.1X/EAP-TLS, smart-card logon, code signing.

Go deeper:

• Wikipedia: Certificate revocation list — revocation reasons and how verifiers are supposed to check them.