createInvoice(customerEmail: string, amount: number, currency: string, vatRate: number) is called in many places, and bugs keep appearing from swapped or invalid values. Which smell and refactoring fit best?

Using raw strings and numbers for domain ideas is primitive obsession. The fix is value objects like Email and Money. A value object validates itself once, when it is created. It also makes mistakes impossible: you can't pass an amount without its currency. You also can't swap two arguments that have the same primitive type, because each one now has its own type.