Diodes on SPI bus data lines and pull-up resistors
They can't protect against ESD strikes but are there to protect against overvoltage.
The connector JP1 is labled breakout, which indicates that the user can connect random stuff to these pins. The diodes protect the inputs against the user supplying the pins with an external voltage. The direction of the diodes only allows a current flow out of the pins, so the user is able to pull the lines low (while pulling them to high is only done by the pullup resistors ob board).

Regarding your second question: It does not make a difference if you use one pullup at only one place or multiple ones with higher values distributed over the bus. Just use one pullup for the whole bus.