This post compares the performance of the circuit using the internal pull-up resistors against external 1kohm resistors, including plots showing the improved signal quality.
Reading the datasheets for both devices would probably avoid the problem.
So 1kΩ is safe, but might be a bit on the aggressive side. At 3.3V, 1KΩ to ground burns 3.3mA, and there are two pull-ups per I2C bus.
The I2C specification is full of these kinds of ambiguities, which creates a lot more work for implementers. SMBus's physical layer is a subset of I2C that tightens these requirements and specifies pull-up current, making these calculations quite a bit easier.
If you're doing coin cell powered stuff, those brief 3.3 mA pulses can really chew up your battery life.
It seems that pulling up I2C pins with 4.7kOhm resistors is a way to go:
https://tronixstuff.com/2011/08/26/arduino-mcp23017-tutorial...
I can absolutely see I2C having issues even more...but for different reasons.
I've only implemented i2c on esp32-s2, and left the pullup footprints unpopulated at first. Eventually I came to the same conclusion and put two 10k resistors on and called it a day. Cost was negligible.
