Because SPI is clocked, and the slave-select line delimits ... If you’re using an SD-MMC card, or if all else fails, or if you’re just somehow superstitious, you can try adding pull-up ...