Photon as SPI Master (normal usage)
The reason for the wording in the data sheet is that because the Photon (or Electron) will only output 3.3V, it’s not really compliant with a 5V SPI device, which is expecting 5V signals on MOSI, SCK and SS. It’s possible, if not likely, that it will respond to the 3.3V signals as high, so it will work, but it’s probably not in spec.
As for A3, it’s not 5V tolerant, but it’s also SCK, which is an output from the Photon.
The only pin that really matters for 5V tolerance is MISO (master in, slave out) and that’s pin A4, which is 5V tolerant.
SPI1 is okay as well; all of the D pins are 5V tolerant.
There could be issues if you have multiple devices on the SPI bus; they must also tolerate 5V on MISO when in Hi-Z mode (SS not selected).
So the answer is: if you have a 5V SPI device that works with 3.3V input signals, having it output 5V on MISO will work with the Photon as SPI Master on either SPI or SPI1.
Photon as SPI Slave (less common)
Don’t use Photon SPI (the primary one, on the A pins) as an SPI slave with another microcontroller that’s a 5V SPI master!
The A3 pin (SCK) is an input when in SPI slave mode, and it is not 5V tolerant. Permanent damage can result.
The SPI1 (the one on the D pins) should be OK, subject to the limitation that MISO will only be driven to 3.3V.
I2C is Different
It is different with I2C because that doesn’t drive the pins high, it uses external pull-up resistors, so if you pull SDA and SCL to 5V, then the signals are actually 5V, so it is completely compatible with 5V I2C.