Fortunatelly, most CMOS devices has been protected from it with clamp Schottky diodes built-in.

I don't think, that these diodes are Schottkys! They are parasitic or additional diffused and show the same threshold voltage as parastic SCR! Built-in protection diodes do only help to prevent latch-up by reducing the probability of occurence. But they cannot guarantee it. If the latch-up protection would always work as intended by manufacturers, then we would never observe any latch-up. But reality looks a bit different...

Twice fortunatelly that pull-up of MCU cannot source high current.

That's right, when port pin has only weak pull-ups activated. But whenever you clear according port pin by software instruction, strong internal active pull-up is activated for two oscillator periods. And this strong pull-up can deliver some unsane current! Strong internal active pull-up is used to allow fast charge and discharge of any capactive load (stray capacitance) connected to port pin, so source impedance must be very low, something in the range of 50...100Ohm.

This example may show you that it is not so simple just mix 3V and 5V devices.

Additional problems arise from the fact, that 3V and 5V devices can show different noise margins. And as 5V devices can show much higher ground bounce than 3V devices, noise margin of 3V devices can be violated all the time!

To mix devices provided by different supply voltages needs an experienced developer. Heavier ground bounce of 5V devices demand for an ultra clean ground routing management, which in most cases cries for a multylayer board design, because only this can guarantee the needed solidity of ground plane.

Again, mixing chips of different supply voltages can be very very troublesome and should be avoided if possible.

Kai