The 'reset state' of all control registers is called out in the Reference Manual, including the 'pin mux' table, but the general statement is: 'reset state is the safest possible for any possible interconnect'. That is, analog-in-capable pins will default to said analog-in mode, and digital pins will default to input, most with 'no pull'.
So yes, by-and-large anything you need to have as a 'known state' during/just-after reset will need your own external pull-resistors.