Well, the SD card has an internal nominal 50K pullup resistor on its pin that receives the CS line. So that line will be high anytime the card is inserted and powered up. But I believe all three Arduino SPI output lines are configured as output high or low, and if that's the case there should be no need for pullups on them.
I think it's only MISO that I've seen legitimate reports of it not working without a pullup. MISO has to go tri-state anytime its CS isn't asserted, and some SD card makers may have decided to just make that output open collector to meet that requirement. I think it would be safe to have a pullup on MISO just so you don't have to worry about what brand your card is. But for major brands, it might well work just fine without the pullup.
For my SD card projects, I put a pullup on MISO, but not the other lines. So far, everything has worked with that arrangement.
One thing that might change all of that is if you ever use MMC cards. I don't know what the spec is on those.