If you have an I/O pin to protect, don't you always need the protection from both positive and negative ESD? I see that many circuits have clamping diodes connected between I/O nodes and power nodes. But only sometimes additional diodes are connected between the I/O nodes and ground. Is there a reason for not expecting negative ESD?
There is no reason to expect that the potential difference between an electronic device and any external object has only certain polarity. It can be both with 50% probability. All pins on ICs usually do have two diodes, to VCC, and to GND, something like this:
Interestingly, it was noticed that "negative ESD" events could be more dangerous for electronics, see this article.
But only sometimes an additional diodes are connected between the I/O nodes and ground. Is there a reason for not expecting negative ESD?
That's not because a "negative ESD" is not expected, it has to do with the way the protection works. The 4 diodes + resistor as shown in Ali Chen's answer is the most used "classic" protection. However there are other equally effective ways to protect against ESD. In some IC manufacturing processes the recommended protection looks like this:
At first glance you might think this protection does nothing. This is not the case of course, the Drain-Bulk diode protects against negative input voltages. The protection against positive voltages relies on the breakdown voltage of that same Drain-Bulk diode. As long as that breakdown voltage is defined well enough (is reproducible in manufacturing) and the breakdown voltage is low enough to protect the gates of other devices, this can be used.
The advantage to use this can be that there is no VDD connection required so the ESD circuitry becomes simpler and possibly more robust. Also the "power clamp" (sometimes called crowbar circuit) is not needed as the ESD currents are handled through the ground (VSS) connection.
The reason for using in NMOS here is probably because that is a well controlled (and well monitored) device. If any other structure was used it might require extra work to monitor its performance (behavior) when the chips are finished. For the NMOS, which is used in almost any circuit, this monitoring is already in place.