Tolerating Logic Inputs in Excess of Vcc
The specification means that, provided VDD is kept within bounds and other limits are exceeded, one may source or sink 20mA from any I/O pin without pulling it far enough to damage the part, and one may connect any I/O pin to a rigid voltage between -0.5V and VCC+0.5V without driving enough current through the clamp diodes to damage the part.  Note that the only guarantees with regard to pulling an I/O pin beyond the rails are those stated above.  In particular, there is no guarantee in the data sheet that pulling a pin even one millivolt beyond the rails won't disrupt the operation of the part--merely that it won't cause permanent damage.