This must be a result of the "named account" feature that was introduced by vSPhere 5.1.
See vSphere 5.1 – Full Admin Support for Named User Accounts for some info on the feature.
It looks indeed as if the New-VIPermission experiences a problem when accessing local ESXi accounts.
If you connect to a vCenter, the cmdlet will look for the local account on the vCenter server.
As a workaround you could join the ESXi to the AD domain.