How does a bare PCB product such as a Raspberry Pi pass ESD testing for CE mark?

Does this answer your question (emphasis added)?

9.3.2 Test method The test method shall be in accordance with EN 61000-4-2 [2]. For radio equipment and ancillary equipment the following requirements and evaluation of test results shall apply. The test severity level for contact discharge shall be 4 kV and for air discharge 8 kV. All other details, including intermediate test levels, are contained within EN 61000-4-2 [2]. Electrostatic discharges shall be applied to all exposed surfaces of the EUT except where the user documentation specifically indicates a requirement for appropriate protective measures (see EN 61000-4-2 [2])

You are right that the Raspberry Pi carries a CE conformity.

Either they write in the manual of the Raspberry Pi that the user MUST use some kind of housing or they declare the product as an experimental board (or toy) that does not need to pass ESD tests and that the usage purpose of this product is very limited.

As you stated correctly: It is hard (if not impossible) to protect a bare PCB assembly from ESD. You could use some sort of coating, but you would still need to protect the uncoated pins.