To reproduce:

1. Starting with Minecraft 1.16.5, install Fabric loader and Fabric API.
2. Install mobdisguises-1.0.0-fabric and disguiselib-1.0.2-fabric.
3. Create a new world with cheats enabled.
4. Find a horse and tame it.
5. Give yourself a saddle and equip it on the horse.
6. Run /disguise @e[type=horse] as spider (optionally replacing spider with any other non-horse entity)
7. Click on the (disguised) horse to ride it.
8. Try to control the horse.

Issue on MobDisguises end: samolego/MobDisguises#4

I can still reproduce both problems using MobDisguises 1.0.4 and DisguiseLib 1.0.8 on Minecraft 1.17.1.
In addition, disguise @e[type=horse] clear on a nearby horse does not make the horse controllable until you reload the entity.

This is more or less limitation of Vanilla client. But it could still be somewhat worked around

This also happens with Striders:

1. Starting with Minecraft 1.16.5, install Fabric loader and Fabric API.
2. Install mobdisguises-1.0.0-fabric and disguiselib-1.0.2-fabric.
3. Create a new world with cheats enabled.
4. /summon strider
5. /give @p warped_fungus_on_a_stick
6. /give @p saddle
7. Use the saddle on the strider, then ride it while holding the Warped Fungus on a Stick.
8. Notice that the (undisguised) strider can be controlled properly.
9. /summon minecraft:strider ~ ~ ~ {CustomName: '""', DisguiseLib: {DisguiseType: "minecraft:player", DisguiseAlive: 1b}, UUID: [I;-1075014358,-807843482,-1879089003,1077279333]} (summons a Strider disguised as a player)
10. /give @p saddle
11. Use the saddle on the (disguised) strider, then ride it while holding the Warped Fungus on a Stick.
12. Notice that you can't properly control the (disguised) strider (it does not move while being ridden by you).

I believe that will happen with any entity that can be ridden but disguised as "non-controllable" (e.g. boats, minecarts disguised as other mobs ...), as entity riding is done by the client afaik.
That's also why hacked clients allow you to control llamas / horses without saddles (if I know correctly).

Fabric Carpet mod already shows that server receives movement inputs from players, in PlayerInputC2SPacket (more specifically at least p.getSideways(), p.getForward(), p.isJumping(), p.isSneaking() where p is the player), and various public servers that have rideable entities make the entity's movement server side. This would theoretically allow for any entity to be rideable and controllable server-side as long as it is actually a disguise of a rideable entity. Could this server-side controllable entity movement be implemented in DisguiseLib?

If I find a way, definetely :). Thanks for the examples.