Yep, that's the reason for IOREF, trouble is that's a new signal and all the old shields don't have it.
So there is some potential for an old shield to put 5v onto a Due 3v3 pin.
FWIW I'm suggesting that the Due have the 5v hole plugged so an old shield (or indeed any shield that can cause 5v damage) cannot even be plugged in by a beginner.
A new 3v3 shield that doesn't need 5v wouldn't have the pin, so it will plug in.
Any shield that does need the 5v can still be plugged in if you remove the keying plug from the socket. One would assume that anybody doing this is working under instructions or knows what they are doing.
Any Arduino team reading this? Is this a reasonable idea or a waste of time 
Rob