SymDiag does an installation integrity check that matches version numbers between the MSI and the registry as well as checks if registry values for services and the services are present. It does not check if the paths of the file and registry value correlate or if the path matches the version (as the files may be stored in a directory that is silo-specific and, therefore, contains the SEP version in a folder name).
You can check this information manually by examining the registry value...
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\<relevant key>\'imagepath'
If you have rebooted the system you can search the registry for the value imagepath with data corresponding to the path of the file you are trying to delete to see if there is a registry key that is still starting that service.
If a SymDiag report from a system exhibiting this issue is delivered to support please have the support agent contact the SymDiag development team to see if this sort of scenario can be captured in a SymDiag report.
Thanks!