all you really need to make the GPIO's 5V tolerant is a series resistor
That is somewhat true. The problem with 5V coming in is that the ESD protection diodes start conducting. They will feed current into the 3V3 rail.
Those protection diodes are designed for high peak currents but for an extremely short period of time.
To make them survive for an infinite period of time you have to reduce the current.
Lets' says you add a 47K series resistor. You then have a diode+resistor with 5V on one side and 3V3 at the other side.
Let's take a standard voltage drop of 0.6V over the diode. You resistor then has 5-3.3-0.6 = 1.1Volt over it.
With a 47K resistor you have ~23uA (micro!) amps going through the resistor and through the diode.
The energy the diode has to cope with is ~25uW. It will survive that.
But the input of the pad will continuous see about 3.3+0.6 = 3.9V.
Not ideal but again it is likely to survive that.
I am an old-fashioned engineer, for the sake of a $0.01 resistor I would not take the risk so I always use two resistors.
There are cases where you can not use two resistors but I leave that as 'exercise for the reader'.