I think that explains everything.

That is true that plugins disable before the server kicks the players... But that would be more a flaw with the server itself (Spigot) and not LuckPerms.
As long as there is no way for a plugin to stay active until all players are kicked, there can't be anything done about that... Maybe report this to Spigot or aks in the forums if that is somehow changeable...

Also from my testings does LP shut down as the last plugin... This could be coincidence of course and can perhaps be random, or it is in fact always that way...

I haven't tried this, but I think you could do it in the onDisable(), and then use something like player.kickPlayer("Reason"); for all players and wait till they have all been kicked (ie trough World.getPlayers(), there could be a more efficient way to get the player-count, but this is the one I remember)

Again. This is not the job of the permissions plugin. The platform needs to handle that properly. Report it to Spigot.

Kicking players on disable seems in my opinion a bit much. Especially considering that there could be issues with other plugins while they're disabling...

Again: This is NOT an issue on LuckPerms side. It's caused by how Spigot manages the loading/unloading of plugins and kicking of players. Also the time between disabling the plugins and kicking the players shouldn't even be a second with over 30 plugins (I tried it on my public server and it really isn't that long.)
So if the players manage to "cheat" then either
A) Is the server slow af causing plugins to disable for ages (Or certain plugin cause the shutdown to delay) or
B) Does the player use a cheat/hack which would already be punishable.