This schematic shows the Atmel AVR ISP circuit as it is normally configured. The ISP signals go directly from the ISP connector to the SPI port on the AVR, in this case an ATtiny24. In addition, there is an SPI bus, perhaps to interface some sort of telemetry, like pressure sensors, temperature sensors, or maybe EEPROM memory.
If for some reason there is an SPI device selected during reset, the SPI MISO line will be in a low-impedance state. Programming will be affected if the programmer is connected directly to both the SPI port and the SPI bus.
To prevent this from interfering you connect the ISP signals directly to the SPI port on the AVR and connect the MISO line on the SPI bus to the AVR SPI port through a resistor (circled in red above). The resistor prevents the SPI connected device and programmer from driving output to output and possibly damaging one or both. MISO is the only line that requires protection, because it is the only line with a contention during programming if there is a rogue SPI device sending to the master. Remember, there is only one master on the SPI bus. A device can't suddenly become a master and start toggling the SCK signal. When the reset line is low, the programmer is the master, and when reset is high, the AVR is the master.
In addition to the MISO line being protected by a current limiting resistor, the figure shows resistors in the programmer lines. This is because if you are using the SPI bus, and the resistors aren't there, when the programmer releases the reset line, it is the programmer that is causing contention on the lines - not the SPI bus! There can only be one SPI master, and with reset high, it is the AVR.
Ultimately, if the CS lines on the individual SPI slaves are in place, resistors in the SPI bus lines are a solution without a problem. The resistors need to be in the programmer lines, or the programmer needs to go into a high impedance mode when reset is released. Avrdude will handle this given a programmer that makes use of the enable lines.