But what about on the device -> arduino?
you can just put a 10kohm resistor inline to drop the 5v out of arduino enough to not fry the other device. Seems to make sense to me
pull-up resistor to 3.3V to try to get the voltage higher. I'd go with the second as it's simple enough.
SD cards in native mode rather than SPI mode are much too fast for the Arduino anyway).