You do need to protect the LED. An ideal diode (a theoretical model) has a forward voltage drop. If your voltage is below this, no current. If your voltage is above this, then the only thing to limit your current is the resistance in the other parts of the circuit. In other words, a small difference in the voltage of a diode can result in a very large current change. Even though a real LED is not an ideal diode, it comes close enough where it needs protection.
The resistor circuit is easy and cheap, but does waste power. Also, the brightness goes down as the batteries drop.
You can also use a linear regulator in current mode. This will allow a constant current throught the LED, but it needs more voltage (which requires an extra battery). These are not used too often.
The best option is to use a DC-DC converter (such as a boost circuit). These can give a fairly constant brightness, and can suck a battery completely dry. This is used in the ARC family of products. The disadvantage is that these circuits can be complex and can be daunting for a beginning to design. The parts also cost money, which raises the cost of the light.
Something that I have never heard anybody is it to use a JFET to control the current. A JFET can be wired to achieve a simple "constant current" mode. Has anybody tried this?