Hello,
You don't need a create privilege to merge contacts.
Privileges needed to merge contact are Append Activity, Append Contact, Append To Contact, Merge, Read Contact, Share Contact, Write Activity and Write Contact.
As you rightly said, it updates the record and allows you to choose one contact as master record which shall remain active and other which gets deactivated after merging.
Hence that's why Write privilege is required rather than a create privilege.
Hope it helps!
Regards, Abhishek Bakshi If you find this post helpful then please Vote as Helpful and Mark As Answer. Check my blog on https://mydynamicscrmblog.wordpress.com/