Correct, this logic is in place for the scenario where you are changing the key `enabled` state as well as performing other changes as they seemingly must be done in a certain order. (This is another carryover from the `aws_kms_key` resource).