You should absolutely not set someone’s password to a value that is stored in plaintext in ISC like an identity attribute. This is a terrible practice for a number of reasons.
A better, much more appropriate solution would be to have an afterModify script that conditionally generates and sets a random password (that is then not stored anywhere) if the operation is disable.