Question:

Why is it not possible to inactivate the only Domain Admin in a Vault?

Answer:

Vault requires there to be at least 1 active Domain Admin with membership to the Vault even if there are other Active Domain Admins associated with other Vaults in the Domain. A new Domain Admin will need to be chosen before Vault will allow users to inactivate a user that is the last Active Domain Admin in a Vault. 

Related Documentation:

Vault Help Documentation: Creating & Managing Users

Vault Help Documentation: How to Grant Domain Admin Access