If the user has Incident User permission, he/she has Task User permission which why he/she can create/update task.
Please see the online document.
https://docs.bmc.com/docs/display/public/itsm81/Task+Management+sub-component
-------------------
Users with Task User permissions have access to updated records.
Recommendation: The following permissions automatically inherit the Task User permission rights:
Task Administrator
Infrastructure Change Submit
Infrastructure Change User
Infrastructure Change Master
Release Master, Release User
Activity User
Incident User
Problem User
Users with any of these permissions do not need the Task User permissions to access Tasks. Give the Task User permission to anyone who needs access to the Task System to update Tasks but who does not have any of the previously mentioned permissions.