Disabled product variant still shows in {% for %} loop
This should filter the variants by their enabled status:

{% set product = craft.commerce.products.id(productId).first() %}

{% for variant in product.variants if variant.enabled %}
    {{ variant.id }}
{% endfor %}