This is really a question for the SD Association. I can't give you "legal advice" and I certainly can't speak for the SD Association. But I can give you some facts.
PJRC has not paid anything to the SD Association.
I'm pretty sure Bill Greiman (author of the SdFat library) probably has not either.
NXP publishes their own code SDIO code as part of their SDK, which anyone can download for free (website registration might be required). You might ask NXP. I have not seen any documentation from NXP about licensing required, and I have read a lot of their documentation!
I believe all the SDIO commands SdFat uses were documented in the original SD Memory Card Specification (version 1.0) published in March 2000. Much of the tech (definitely 4 bit mode) came from earlier MMC cards, which were sold as early as 1997.
Again, this is not legal advice, but generally patent rights last 20 or 21 years. However, before late-2000 a practice known as
submarine patent was possible, so the situation can be complicated. Since the original SDIO spec is now more than 24 years old and MMC is even older, it's difficult to imagine patent rights could still apply. There are other aspects of IP law than patents, so your best approach would be to consult with an IP attorney.
But this is really a question for the SD Association. If anyone gives you a clear answer, I hope you'll share.