Hang on - isn't that the same in ASP.NET 1.0 and 1.1? Oh yes.
All web controls that implement the IPostBackDataHandler maintain their basic 'value-state' (for lack of a better description) using the HTTP POST form collection. Irrespective of setting the EnableViewState property for the web control to False.
Nothing has changed in ASP.NET 2.0 as far as that is concerned. The CheckBox control along with TextBox and other controls that implement the IPostBackDataHandler interface, still maintain their basic value-state using their respective HTTP POST values. ControlState has nothing to do with this.
ControlState is a way to allow more fine-grained control over individual portions or behavioural elements of a web control, which under the bonnet actually still uses the ViewState statebag. Fritz Onion's article outlines this nicely and in more detail.