You are deleting an 'open file'.
/var/log/cron is an open file, which means that your logdaemon (probably syslogd) keeps this file open to write output too.
When you delete the file and create it again, the 'pipe' from syslogd to /var/log/cron points to the deleted /var/log/cron and not to the newly created /var/log/cron (there's a bit more going on, but I'm keeping it simple).
So, instead of using:
rm -rf /var/log/cron ; touch /var/log/cron
This will empty /var/log/cron without breaking the pipe.
Hope this clears things up a bit.