Why should an IAM data source that is no longer needed actually be decommissioned (Rückbau), instead of just left running?

Two reasons: it saves cost, and data protection allows no processing of personal data without a purpose; once the need is gone, keeping the flow alive is unlawful processing.

Cost saving: every connected source costs money even when nobody uses its data: the connector has to be operated, monitored and patched, the delivery agreement maintained, errors investigated. A connector nobody needs still breaks during upgrades.

Data protection: personal data may only be processed for a specified purpose, and only as long as that purpose requires (purpose limitation and storage limitation). If the need for a source has disappeared, for example because the division and its people are gone, then continuing to import and store those people's data has no purpose, and processing without a purpose is not allowed. Decommissioning therefore means more than switching off the interface:

• stop the deliveries,
• delete or deactivate the data that came from the source (and the accounts built on it) according to the retention rules,
• close the data delivery agreement.

A forgotten, still-running feed is also a security risk: an unmaintained interface carrying personal data that no one is watching.

Go deeper:

• ICO: Principle (e), storage limitation — why personal data must not be kept once its purpose is gone.
• Data retention (Wikipedia) — retention periods and deletion obligations for business records.