The bug is in the ethernet library code. I have researched this already. All SPI devices should end up in a disabled state after the setup. I know the Ethernet.begin() function returns with the SPI enabled, both in the code and by experience.
edit: It is not a matter of the MISO line. It is the slave select pin (digital pin 10). Ethernet.begin(mac) returns with digital pin 10 LOW (SPI active).