I believe you are incorrect.
Sorry, that was badly worded. I meant, as you wrote, that the pull-up is only supposed to be active when VBUS is high.
I don't think you're doing anything wrong. You just got unlucky and chose two parts that are incompatible in a way that's not evident from the datasheet.
If I were to apportion blame for this problem, I would say the PIC32MX is the worse offender. While the USB device checklist requires a threshold between 1V and 4V, that appears to be for ease of real-life implementation. The USB spec defines valid Vbus high as 4.01V. In the end, the PIC32MX is holding the pull-up on when VBUS isn't at a valid high, even if it is the addition of the diode that makes this behavior problematic.
At the end of the day, I would just swap out diodes or add a resistor divider to the vbus pin on the PIC32MX to effectively increase its switching threshold. (Assuming you're not using OTG.)