Using a pull-up to 5V on a 3V3 MCU can be just fine if the MCU is designed for that. Some are rated for it and some have a design the will work okay. Since it is a pull-up, when the MCU input protection circuit goes active it will be able to lower the voltage without needing to disapate too much current.
I used to use 5V for the power pin and didn’t have problems. I now use 3V3, since the esp8266 is not rated for 5V on the input pins (there is some debate on this, but it isn’t clear that it is 5V tolerant). I have not had any more problems since I switched, so I don’t believe 5V is necessary if runs are short. The datasheet does recommend using 5V for both pull-up and power when you need maximum range, ie 100m or so.