I think you might be jumping to a conclusion a bit too quickly...the lack of a simple protection diode to VCCIO does not mean the device is 5V tolerant. In fact, it seems like having no protection diode is the default in modern FPGAs. I went through the CPLD/FPGA datasheets I had saved locally, and collected their absolute maximum ratings for input voltages and checked if the datasheet mentioned a protection diode somewhere. None of the devices support true 5V VCCIO but some are defined to be 5V-tolerant when 3.3V VCCIO is used, as indicated by the max rating.
CPLDs:
- Xilinx Coolrunner-II: no diode, max 4.0V
- Xilinx XC9500XL: no diode, max 5.5V
- Lattice ispMACH 4000 V/B/C/Z: no diode, max 5.5V
- Lattice ispMACH 4000 ZE: no diode, max 5.5V
- Intel/Altera MAX II: no diode, max 4.6V
- Intel/Altera MAX V: no diode, max 4.6V
FPGAs:
- Xilinx Spartan-3E: has diode, max VCCIO + 0.5V
- Xilinx Spartan-6: no diode, max 3.95V
- Lattice iCE40 LP/HX/UL/UP/LM: no diode, max 3.6V
- Lattice iCE40 Ultra: no diode, max 3.6V
- Lattice MachXO2: no diode, max 3.75V
- Lattice MachXO3: no diode, max 3.75V
- Intel/Altera MAX 10: no diode, max 4.12V
- Intel/Altera Cyclone IV: no diode, max 4.2V
- Intel/Altera Cyclone V: no diode, 3.8V
- Intel/Altera Cyclone 10 LP: no diode, max 4.2V
So, based on this very quick investigation, only one of the devices (Spartan-3E) has I/O protection diodes to VCCIO, and it's from 2004. Some devices support a switchable clamp diode to VCCIO (for PCI I/O compliance?), but that depends on configuration and isn't always enabled. Just because some previous generation devices (iCE65) manufactured with an older process (65nm) had 5V-tolerant inputs in some banks, it doesn't mean the next generation has the same characteristics.
I don't know about the manufacture side of things, but the lack of a protection diode to VCCIO provides one practical advantage I didn't see mentioned yet: a normally valid high signal on an I/O while the CPLD/FPGA is powered off won't get shunted to VCCIO. This adds some flexibility to power sequencing and/or supporting multiple switchable power domains on a board, because you won't necessarily draw excessive current from the I/O pin of some other device even if you are outputting a valid high while the CPLD/FPGA is off. Just recently I encountered this with a design where I realized I made a mistake in power sequencing and was outputting a digital 3.3V signal to an unpowered iCE40 HX4K in certain scenarios. I panicked and thought I broke the other device and had to respin the board to avoid the problem, but I read the datasheet and even measured the current drawn by the iCE40 pin in this scenario to double-check it was safe: the current was 20 nA

I've also intentionally used extra 74LVC buffers in some designs to safely isolate different power domains, because 74LVC doesn't have VCC protection diodes and doesn't get upset with normal I/O voltages in its inputs while unpowered.
Based on the available evidence, I'm almost certain that iCE40 HX is
not 5V-tolerant, and if you exceed its maximum rating, you're going to break something over time. It might not be spectacular "smoke escapes device" kind of breakage, but maybe the gate oxide layer of the input buffer transistors break and you lose each pin that has suffered this overvoltage condition for some period of time. Not fun to debug if it happens! Remember also that gate oxide degradation is cumulative (and IIRC non-linear w.r.t the input voltage...?), so a single quick test is not enough if you care about the longevity of your device.