IIRC, shareReplay is the problem. There is some debate about its current implementation — which was changed in version 5.5.0-beta.4.

Essentially, the current implementation of shareReplay will never unsubscribe from its source observable. When used, it relies upon the source observable either completing or erroring.

So, yes, you are correct in that placing takeUntil before shareReplay is necessary to effect unsubscription from the source.

Perhaps I should add another rule to rxjs-tslint-rules that warns about shareReplay being used? Or should make the takeUntil rule aware of the shareReplay quirk?