I did a bit of research and found SD specs require pull-ups of 10k to 100k.
The SD card pads are bi-directional with tri-state drivers, and are in a high impedance state until enabled by the SD card, which may not be when the CS line is asserted as the card is not in SPI mode initially. Leaving any digital signal in a floating, unknown, state is not a good idea.
Typically lower power requirements than I²C or SMBus due to less circuitry (including pull up resistors)
It probably works without the pull-ups most of the time, but I found a case where it doesn't, and that's why pull-ups are required, so it will work all of the time.