The manage rules does indeed have a create rule link which is not protected by any permissions check so this could be deemed as a bug. Feel free to raise this in JIRA.
However, the page that contains the link is navigated to via the Manage Rules action, which is protected by a "CreateChildren" permission check. This means that only users with the "CreateChildren" permission should be able to get to manage rules screen and thus to the create rule screen.
Contributors and Collaborators do not have the "CreateChildren" permission, so in theory the manage rules action should not be present. The best thing is to raise this issue in JIRA and we'll investigate further.
