I also understand that the multi-million ohm resistance is only for pins explictly configured as inputs in code (not an innate protection),
Also not exactly correct. The AVR chip using it's built in design, forces all I/O input pins to input mode upon a reset or power up action. So pins default as input pins and that is not dependent on a users code to set them as such. Only by user programming commands will an I/O pin be switched to output mode. So if you want to wire a series 200 ohm resistor to all I/O pins to protect from possible user software errors or external wiring errors or external hardware component failures, then you are free to do so, but it's not a requirement from the chip's point of view.
Lefty