10K pull up, are for open drain pins, as in I2C bus, in SPI there's no need of them.
We're talking SDcards and microSD, pullups are needed I think. Found this:
The SD physical layer specification does not have much to say about pullup resistors, except that they should be used to prevent excessive current from floating inputs. That applies especially to pins 8 and 9 on the card (the ones on opposite ends), which are not used in SPI mode.
Basically any floating input is bad news, especially on ultra-high frequency inputs
like the native-mode bus. Given the large variety of SDcard makes out there, protect
yourself from the poorly compliant ones by being paranoid.