I say yes since the vulnerable code is still sitting right there in the web directory which can (will) be scanned by potential attackers. Monitoring disabled modules is certainly part of our update routine.
I didn't find a whole lot of discussion on this in regards to Drupal in particular. Greg Knaddison (@greggles on Drupal.org) noted on a thread a few years back:
Sometimes the vulnerabilities exist regardless of whether or not the module is enabled, so I think it's better to warn on all modules.
Source: Issue #942960: Don't warn about security updates for disabled modules
As always, best to err on the side of caution.