The 1 MΩ resistors are sufficient to reduce the voltage and current of the normal 110–240 VAC mains sine wave to a level that the AVR can handle.
However, the application note admits it's incomplete:
Any voltage higher than 1,000V would probably be spikes or surges. The clamping diodes are able to
handle spikes for a short period of time but not surges. The application note will not go into how to protect
against surges, but simply recommend implementing protection against surges in the design.
And, of course, the AVR chip is not isolated from mains, so you have to protect the entire circuit against touching. If you have something like a display or control panel, this will be much harder than just putting an optocoupler before the microcontroller.