The "Control by mobile apps" functionality is mostly broken - "disabled" only applies to third-party apps using the "Play on Roku"/ECP protocol/functionality, not to Roku apps or any DIAL protocol apps.
Spotify uses DIAL casting protocol on Roku, and RokuOS has no permission controls for it ("Control by mobile apps" doesnt apply).
Roku should have a DIAL access control, but they dont.
NetFlix, YouTube, YouTube TV, etc, use DIAL on Roku as well and would also be prevented from casting.
You can report this to Roku: https://support.roku.com/contactus
or suggest DIAL access control: https://community.roku.com/t5/Suggest-a-Feature/bd-p/Wishlist