Are pull-up resistors needed when connecting buttons to a IO expander?
Question: do I really need to add resistors myself between the IO
  expander and the switches or not?


No, you don't need to add any external pull-up resistors, as long as the internal 100k pull-ups are good enough (read: result in an RC time constant fast enough) for you, and you don't end up with any significant switch bouncing problems either.

However, internal pull-ups are disabled by default. You need to enable them  through configuration of registers GPPUA (address either 0x06 or 0x0C, see below) and GPPUB (address either 0x16 or 0x0D, see below) according to this pattern (from the datasheet):



Note that the address of the GPPUA and GPPUB registers depends on whether you're using the MCP23017 in 8-bit or 16-bit mode (something you configure through IOCON.BANK). This table from the datasheet tells you which address should you use for each mode: