When a device with TMS and TCK both pulled high is powered up, the JTAG TAP controller should stay within the base, or TEST_LOGIC/RESET state. However, during some power up processes, the transition from the unpowered low level to a powered high level occurs at slightly different moments in time between TMS and TCK. See Figure 9 in AN 122 (Using the Jam Language for ISP via an Embedded Processor).
If TMS and TCK rise to a high level at the same time, or if TMS rises before TCK, you should not have a problem. However, if TCK rises before TMS, the JTAG TAP controller will recognize a rising edge on the state machine clock, with a TMS signal equal to 0, and will shift the device into RUN_TEST/IDLE state. The device stays in this state until it receives further control signals from the JTAG port. Therefore, TCK should be pulled low through a 1 kOhm resistor, both for blank and programmed devices. See Figure 4 in AN 95 (In-System Programmability in MAX Devices)