The stop-diodes are going to steer current, but in
the 5V-supply-involved loops there has to be a
return leg. This may be assumed to be the "5V"
node/rail but this assumption can be invalid - say,
if the 5V power supply is not there or is instead the
source of the threat, or the 5V supply lacks sink
capability (often the case with local regulators
and even full size "box" supplies in my experience).
Schottky diodes can be "brittle" as they are not meant
to go into breakdown. You need a single pulse
avalanche I*t rating that accommodates whatever
you define the bounding threat waveform (V, I, Z)
to be.
A single ground returned zener (say, 6.2V) on the
wiper might do as well, and need nothing from the
5V supply. Or maybe a boosted zener (5.1V zener
drives NPN base against a sensible shunt B-E) to
get more current capacity than a zener can handle.
For diodes to survive reverse overvoltage there
needs to be a limiting resistance. Where that is
best put, to protect effectively without compromising
accuracy / leakage / whatever, is a trades exercise
following from a better definition of the threat-space.
You call out one possibility (10V connected somehow
to some point) but of course any exposed conductor
is fair game for any present voltage (current loop). Just
what -is- present, possible, credible is always an up
front challenge to protection network design, and the
completeness of this understanding is key to the end
effectiveness "against the world".