Since the device is not powered, the internal hot socketing signal is active, thus tri-stating the output buffer. The weak pull-up may have some leakage, but it should be minimal since VCCIO is tri-stated. The static leakage is expected to be close to zero (or at least below the 10uA spec) based on design.
