To prevent WebDav from getting enabled at all, remove the following entry from the ApplicationHost.config:
The entry is located in the modules section.
Exact location of the config:
C:\Windows\System32\inetsrv\config\applicationHost.config
This worked well for me in .Net Core 2.1