We've had several discussions about pull-ups (and pull-downs).
In my "humble" opinion one should never leave an unused input floating. They do have some built-in pull-ups and pull-downs, but they are very weak (comparable to 50-100 kOhms). They're probably not even resistors but cmos current sources.
Any kind of electric or static noise will make the input go up/down/stray or may even crash the esp.
So really, just add pull up and pull down resistors wherever there is an input floating.