The microcontroller is part of a circuit board which contains a large ground plane. This in itself will protect the IC. There is also regulation and filter circuitry onboard which will also offer some level of protection.
If this is some sort of mission critical system, where failure would be very expensive and/or impossible to fix, then ESD protocols should be followed.
The vast majority of Arduinos will live in an ESD-unsafe (maybe even ESD-hostile) environment for the rest of their lives once they're removed from the box. This does not appear to be a problem to date.
How do you think ESD materials work? They are simply a conductive material on which charged electrons repulsed by all having the same charge, move away from each other which forces them onto the outside of the bag and away from the component.
If you take a microcontroller, it is not conductive, apart from the pins. This means that the ESD builds up on one or more of the pins creating a potential difference across the IC of anywhere upwards of 10kV. This can damage the IC.
If however you take an IC connected to a board with a ground plane. Where does the ESD go? Well, all the electrons can happily transfer to the ground plane which is nicely conductive and move away from each other, and critically away from the IC. This means there is no buildup of potential across the IC pins.
As a side note while that board is nicely inside its cardboard box, where does an electrostatic discharge come from? Last time I checked the box isn't particularly conductive, so it is unlikely that a discharge will jump to the box, and if it does, it will built up on the outer surface - just like an ESD bag.
You are rarely lucky enough to know you have ESD damage, till later....
101 on ESD damage.
Typically affects on outputs, not inputs.
Output circuits, although shown on the 'schematic' for the chip as a pair of up / down fets , are in fact a number of fets in parallel, typicaly 3 to 5.
the reason for this is speed / power. The output fets are different sizes, small ones, can drive fast, but not much current, up to the big one that drives biggest current, but is slower.
ESD damage tends to blow the smaller of the fets. This has two effects.
the output is slower, and typically it has a small short circuit on it from the blown fet.
so the output will still 'work', but not as fast as it should, it will typical have more running on it than it should, and the output will get worse over time.
Analogous to driving too big a load, the output can do it, but I'd not want to for anything that is meant to be reliable over time.
SO ESD, dont do it.
it will bite you in the but some time ,
I think a lot of newbies are discouraged by damaged devices, thinking that they are doing something wrong. More and more distributors are shipping with partial or no ESD safety precautions.
Sure, modern ICs have more built-in ESD protection, but why stress it? There is a misunderstanding about how static charges build up, that it requires conductors. It does not. Usually at least one side is an insulator, or both. At one of my jobs, we took all kinds of ESD precautions, but then big nylon web belts were loaded into grey plastic buckets. Sometimes a huge charge would build up inside the bucket, causing the outside metal carrier to be charged by induction. You'd get a rather hefty shock from grabbing the metal, then reach inside and really get hit.
It generally takes a few thousand volts charge for you to feel, hear, and see it. But it may take as little as 20V to blow a MOSFET or BJT.
I once worked for a company when ESD started becoming a concern.
the stores team were told all electrical stuff was ESD sensitive, so they spent a fortune earthing and lining all the draws with a nice metal shield ( tin foil to you and me ).
It took us a while to work out why the new AA batteries from stores always seemed to be flat !!!
Some of the cleaning staff here thinks that they can't mop our grounding floor mats "because they're wired to electricity". Well, if it stops them from mopping them, we leave well enough alone. It isn't their job to know.