Grumpy_Mike:
and the Arduino I/O itself is on 3.3V I/O
This has me puzzled can you explain more?
Well, you can power the ATMEGA328 at various voltage levels. My understanding is that the voltage you power it at will be the voltage of the digital outputs, and also the voltage of the MOSI pin, for example. If you power the AVR using 3.3V, the MOSI pin will also be 3.3V. That's important for wireless modules that can't tolerate voltages above 3.3V.
But what happens if some other input pin is exposed to 5V, like from an ultrasonic distance sensor? Will the 5V on that input pin somehow put 5V on the MOSI pin?