AD groups and ms SQL security: is this default behavior?
Why do we still get the highest permissions, even when AD group is
  removed from logins, and disabled in DB users?


This is because testuser is a member of both AD\testgroup1 and AD\testgroup2 and both those groups exist in the database with object permissions, resulting in cumulative object permissions for the testuser role member. 

There is no requirement that a login exists for a Windows group database user; one can add a Windows group database user and grant permissions to that user regardless of whether a login for the Windows group exists. Permissions granted to groups will be honored for role members even if a corresponding login doesn't exist, as you've observed. 

Without an individual login for testuser, the user must be a member of at least one Windows group with a login to connect to the server. This was AD\testgroup1 in your example after you dropped the AD\testgroup2 login. But the user still had object permisssions granted to AD\testgroup2 until you dropped the user.