That's it. The device must never pull down D+. Never, even when it's unpowered.
Because it must not pull-down in the opposite state.
I've recently been looking into making my own STM32F103 board and wanted to do the D+ pull-up-to-GPIO thing but, same as the OP, I couldn't figure out why most designs use a transistor.
The "never pull-down" reason seems somewhat valid, except that when unpowered the pin tested to be floating, with a 33M+ resistance to ground. I guess that's not guaranteed and ST might re-design the chip later to not behave like that but that's not very likely.
Also, if using a PNP transistor, if we assume that the chip could pull down through the GPIO, then wouldn't you still be pulling down through the PNP diode junction + GPIO ?
Has anything come up in the meantime since this post was originally made to explain why the pull-up-to-GPIO is not the most pervasively used one ?
PS: The GPIO pin has a 22R resistance when outputting logic 1 which doesn't seem like an issue.