This could be for either of a couple reasons. Check your site's anonymous settings and see if it's set to use the app pool identity. If so, then the IUSR account isn't used. Instead it uses the app pool identity, allowing you to only have to maintain a single account.
The other possibility is that your folder already had access. For example, if "Users" already had read access then your site will likely work.