According to the documentation the enabled flag must be set to null (…

…or nil)

in order for the association to be destroyed. Setting this to false keeps the
association in a disabled state instead of destroying the resource.

Documentation on this API endpoint can be found here:

https://developers.cloudflare.com/api/operations/per-hostname-authenticated-origin-pull-enable-or-disable-a-hostname-for-client-authentication

Referencing issue raised on provider:

#4648

internal/sdkv2provider/resource_cloudflare_authenticated_origin_pulls.go

@@ -123,7 +123,7 @@ func resourceCloudflareAuthenticatedOriginPullsDelete(ctx context.Context, d *sc
 		conf := []cloudflare.PerHostnameAuthenticatedOriginPullsConfig{{
 			CertID:   aopCert,
 			Hostname: hostname,
-			Enabled:  false,
+			Enabled:  nil,
 		}}
 		_, err := client.EditPerHostnameAuthenticatedOriginPullsConfig(ctx, zoneID, conf)
 		if err != nil {