If you have any diodes then put the 10K in series with the piezo, then to the arduino input. Then put a diode from input (cathode) to 5V (anode) and another from the input (anode) to ground (cathode).
A series resistor might not add much protection, a piezo element is a close to ideal current/charge source in parallel with a capacitor.
Would not damage the arduino, but might load down the piezo too much and thus you would not see a measurable voltage.The piezo puts out some current - that current needs to go somewhere. The 1M gives it a place to go besides into the arduino.You still need some to go into the arduino for the ADC's sample & hold to charge up - 10K might drain too much away and not leave enough to allow the sample & hold to charge up.
voltage = resistance x current.The piezo outputs current (at almost any voltage - it doesn't care). The resistor fixes the voltage to be afunction of the current.Put another way the piezo pushes out electrons as hard as it needs to to get them out (they are almost literallysqueezed mechanically out of the crystal). With no resistance load the voltage will go up to 1000's of volts (orwith the arduino simply conduct away through the protection diodes). So you would see a nearly square waveand lose all the analog detail.[ actually to be a bit more accurate the piezo outputs charge proportional to physical distortion, but otherwise actslike an insulator (with some capacitance) - this is how ferroelectric materials behave, mechanical strain coupled to chargedisplacement ]