> The safest thing is to have a 4th vref/vccio pin, then the debugger should power its tx signal from that pin, at whatever voltage it's at. Same for the RX pin, it's not nice to have a pullup to a certain voltage when the target is off.

I totally agree. And yet, the 4th pin is, from personal experience, dying out. Because people have been, er, let's say "undereducated", in how to use it correctly, and with cheap USB-TTL-serial, the circuitry to use it correctly isn't included on either side.

And then people reverse-power their boards and fry things, so the board designers remove the 4th pin.

We can't have nice things. :'(

P.S.: the "undereducation": if neither side has a Vref INPUT(!) you leave the connection open. And unless your USB-TTL-serial is very explicit about it, it does NOT have a Vref input.