Create order permissions is actually for creating orders on the admin side. There's a separate setting in the checkout settings form to turn off anonymous checkout. See this doc page for more info on checkout settings.