At the moment, any staff user can create public and private lists - without any specific "Lists" permissions. There should be 2 new permissions "create_public_lists" and "create_private_lists".
Actually bug 13888 did add create_public_lists. I'll have to review this...
So we have create_public_lists in 24.11+ which is good. I think we should have a create_private_lists permission still, since you may not want staff to be able to create private lists.