Probably because Twitter permissions granularity is very sparse. Last time I checked it was just read the whole account or read/write the whole account.

Thus, to create private lists on your account they need the permission to write.