Independent of coating, every IO of an active component / controller / SoC / whatever should be protected, unless it has some built-in protection (usually only specialized IO drivers), OR the connected circuitry - e.g. a voltage and current limited driver, or an open collector circuit - assures that the maximum ratings cannot be reached.
Protection can be as simple as a small value series resistor, or TVS diodes, ...
I would also recommend to never directly connect a controller pin to the outside world, except for only internally accessible programming / debug pins. Use drivers / receivers, plus protection circuits (and also think about where the surplus energy goes).
