When you have a pin in INPUT mode it is high impedance. That means that to all intents and purposes, to the outside world, the pin is not connected to anything internally.
In reality it is, but that internal connection is of such a high impedance (i.e., resistance) that it is almost equivalent to an open circuit.
It's simplest to think of an input pin as a voltmeter. A pulldown resistor and button would look like this:
simulate this circuit – Schematic created using CircuitLab
When the button is opened the voltmeter reads zero, because one end is connected to ground, and the other end is connected to ground through the resistor.
However when you press the button the voltmeter reads the voltage across the resistor - that is, 5V - because one end is connected to ground and the other to 5V, with a resistor across it.
If you don't have the resistor then the voltmeter can't measure anything when the button isn't pressed - it's just waving around in the air without a clue what it's doing - and a wire waving around in the air is called an antenna...
The Arduino is that voltmeter. All it does is detect the voltage at the pin, it doesn't conduct any (or only a very very tiny amount of leakage) current through the pin.
Now the possibility of a short circuit comes when you set the pin to OUTPUT. If you drive the pin LOW then the pin is essentially connected to GND, and pressing the button will connect the 5V straight to GND through the LOW-driven IO pin.