Why is a resistor needed in zener protection circuit?
So, let's do the math here.

Image these real-world figures:
R3 = R4 = 100 Ohm,
Zener = 4.7V,
Vcc = 5.0V,

In scenario 1 (top picture):

You are naughty and apply 12v to the I²C SDA-input (The right side of R3).

The current flows through R3 and D1.


The voltage drop over D1 is 4.7V (over-simplified).
The voltage drop over R3 is 12V - 4.7V = 7.3V
The current through both R3 and D1 is 7.3V / 100E = 0.073A
The power dissipated in D1 is 0.073A * 4.7V = 0,3431W


So, if you chose a 0.5W zener diode package, the zener does not explode.
The voltage seen by the SDA pin is 4.7 volt. So your I²C device is not blown up.

Scenario 2 (the bottom picture):

You once again apply 12V to the input SDA input. The current once again flows through R3 and D1 in the same way it does in scenario 1:


The voltage drop over D1 is 4.7V
The voltage drop over R3 is 7.3V
The current flowing through R3 and D1 is 0.073A
The power dissipated is 0.3431W so the diode doesn't blow up.


But... The voltage at the pin of your I²C device is now the full 12V. Because all voltage is dropped over R3 and D1 combined. This will damage your component.

I hope this makes it somewhat clear how the zener protection works.



Addendum:
If you want to know what happens when R3 and R4 are too low, make the calculations again with R3 = R4 = 1 Ohm. (Zener will dissipate +/-34W and blow up).
If you make R3 and R4 too high, then the zener might not operate as intended (they need some amount of current to zener at the correct voltage).

Also, if the other devices connected to your I²C signals pull the bus low, the logic level will be shifted upwards.