Hello,
As a general rule, we are never too safe, you are right.
The I/Os already have a circuitry to prevent damages from ESD. Qualification of the µc means it passed the Human and Charge Body models (HBM and CDM).
Internal protection include clamping diodes to rail.
My explanations/reasons were primarily for
Stop Mode
Idd (current) limitation.
I don't consider external resistors as being useless. Removing them is usually a question of budget.
The other advantadge with external resistors is that you can easily do modifications on the same PCB.
This could be interesting during failure analysis, for instance, to pinpoint which component is faulty.
Cheers,
Alban.