I looked at Basic Settings > Connect As... It was already set to use "Application User (pass-through ...)".
While looking for what you meant by Basic Settings, it came to my attention one can Edit the user for Anonymous Authentication. That was set to IUSR. I set it to Application Pool, also.
Anyway, I demoted Everyone, and the site is working when I log out, refresh, stop/start Application Pool. I'm not certain everything has been refreshed thoroughly enough to make sure my browser and the server aren't just using cached versions. But, now it suddenly works w/o setting everyone to "Modify", even if I set the Anonymous user back to IUSR.
I don't know.

Impersonation has since been disabled, as part of following the instructions for getting AD-Pro Authentication to work. So now the site is currently running with only Anonymous and Forms authentications enabled. (The AD-Pro trial has expired, so that's no longer in use, but the settings are all the same.)
I just couldn't find anything that confirmed or denied setting it one way or the other. So, yes! Disabled now.