The manufacture (while working with one of our larger customers) of the module found that in some use cases that the 10K resistor was required externally to prevent errors during boot. Because we could not pin point all the use cases where it would be required, we ask that customers provide the external pull-up as a preventative measure.
Well,yes, you posted this explanation earlier. But it does not really help deciding what to do. Especially if power consumption is critical.
And to be honest I cannot think of any reason why a WP signal would interfere the boot process - unless the underlying EEPROM behaves erratic if the WP pin is floating. If this is the case then it should not matter if WP is pulled-up or pulled-down.
We would love to use a pull-down rather than a pull-up because this would make more sense in real-life use cases.
Many add the recommended pullup, but many others have left it floating. I am not aware of anyone that is pulling this pin low externally, so this configuration has not been tested.
Maybe others can comment.