SurferTim:
So the resistor only protects the Arduino? Do you feel it is ok to connect those LEDs directly to a 5v power supply directly with no resistor, and they will survive?
You answer your own question....
If the most it can handle is 40ma before damage potentially starts to take place, and that LED is drawing > 40ma (to damage it) then there's probably a good chance that the LED to might be damaged hence you WOULD need a current resisting limitor....
if however the Arduino could output a precise voltage which happens to be the correct forward voltage, required for the LED to glow safely within it's tolerance given by the manufacturer/datasheet, the current heat and conditions at that moment in time (to adjust the current (or turning a potentiometer for winter/summer conditions) were taken into consideration, then yes you could get away without one, but since that's not the case you indeed need a resistor.
(Any more questions?)