So if you limit the input current (typically <5mA, and assuming the steered-to rail uses at least 5mA to sink it) it will survive any voltage. (Of course if it's a low power design or the device is off this wont work that well, then you want external clamping)
I have tested 24V AC applied to an stm32f0 pin with a 10K series resistor and it survives that indefinitetly.
Which mode was the pin in? I'm not an STM person but my understanding is that most MCU pins are tri or at least multi-mode, if you have the wrong mode set it's effectively isolated.
Edit: Can't reply to child. Schmitt trigger circuitry is disabled if pin is in analog mode or is an ADC pin according to https://www.st.com/resource/en/datasheet/stm32f071cb.pdf page 59 .. could affect sensitivity ... perhaps there exist other mode-related influences, too.
there do exist cmos chips with pins without input clamping diodes but they are rather exotic usually
esd cell -> optional pull ups/down -> schmitt trigger.
Unless I really need WiFi, I prefer to go with ATmega. Once you get used to writing structured assembly language, you can get so much more functionality fit within flash memory.
I can short circuit an Arduino pin for days, or (attempt to) pull 3 or 4 times the rated current from them - and they just keep on rocking. I've even accidentally hit them with 7.2V or even 12V on the GPIO and not had them let the magic smoke out.
You only have to look sideways past a 5V rail at as RasPi to kill it, and ESP aren't a heap better.
If I can get all the code I need onto an Arduino/AVR, I'll use one. If I need more complex code than I can run on an Arduino but still need GPIO (especially anything 5V tolerant) I'll use an ESP or RasPi (or some other Linux SOC board) with an Arduino (or other AVR) for GPIO. At least for the prototyping stage when I'm using breadboards and moving wires around - if I'm building something permanent (or at least semi permanent) I'll sometimes build a version 2 with level shifters to deal with 3.3-5V stuff, but mostly only once I've got to the "prototype that's got to the PCB stage" iterations. I've almost never killed an Arduino, but I've killer too many RasPis and way way too many ESPs.