It wasn’t the Create New button, after all, it was the “Attach” button, which reassigns a child record from another parent to the current record. That one was causing the issue, and I couldn’t get that to go away with permissions.