Is there another source for untrusted foreign keys beside FK disable and BULK inserts?
Another source is a bug in MERGE that allows foreign key constraints to be ignored. This was reported by Paul White, closed as Won't Fix, and has been ignored ever since. It's one of the main reasons I've long been vocal against using MERGE at all.


MERGE query plans allow FK and CHECK constraint violations (also reported here)
MERGE with caution


There are other possible scenarios too - I haven't thoroughly checked out this one about check constraints to see if it could also affect FKs, and another one I didn't read is this one...

While she focused on the performance aspect, my co-worker Melissa Connors wrote a great post on finding and fixing untrusted foreign keys:


Trust issues hurting database performance?