Datasheet SCPS212I Miscellaneous Pins table states that for GPIO0/1/2/4 there is an internal active pullup resistor. The table does not have a similar note for GPIO3.
In section 6.10 of the same datasheet, the footnote to IOZP states that the it applies to “most GPIO”, so the datasheet seems consistent in this regard.
However, checking the Implementation Guide, SCPA045D, strongly suggests that both GPIO3 and GPIO4 may not have an internal pullup as it states “Internal active pullup transistors are present on GPIO terminals 0, 1, and 2. When a GPIO terminal is configured as an input, the internal active pullup transistor is enabled. If a GPIO terminal is configured as an output, the internal active pullup transistor is disabled.”
It is noted that Errata SCPZ008B does mention that certain internal pulldown resistors don’t work, but the GPIOs are not affected.
Assuming GPIO4 does have an internal pullup, and in a situation where it needs to be pulled low in order to disable the serial interface, (and therefore allow GPIO3 and GPIO4 to operate as GPIO lines), an external pulldown resistor needs to be used.
With IOZP max 100uA, a nominal 10kohm pulldown seems appropriate, but perhaps a stronger pulldown is needed, since 100uA current strength and 10k would give a 1V level, which, when VDD is below 3V3, does not quite satisfy the VIL logic low threshold of 0.3VDD max.
In summary:
Does GPIO4 have an internal active pullup?
What is the recommended external pulldown value for GPIO4?