Plug-in surge protectors are almost useless, as they are only as good as their ground. Most modern homes have many wire nuts in the ground path between the outlet and the panel, which introduces a small bit of resistance. When a surge occurs, the protectors shunt hundreds or even thousands of amps to ground, but the resistance from the wire nuts causes the voltage at the plug to spike. Then it takes whatever path it can find, which could be back through equipment and communications links.
In short, once a surge gets into your home, it goes all over the place. For best protection, install a surge protector on the electrical panel and make sure the panel's ground is solid (a big thick copper rod sunk in the ground.) If you don't know how to do this, get an electrician who is skilled in surge protection. Further, make sure all external metal communications cables are grounded and surge protected at the entry point. If you do this, you'll be protected against a wide variety of surges. Close or direct strikes will still get in. The only way to avoid those is to install a full lightning protection system similar to what's used on radio tower equipment huts - but that's way overkill for residential.
As for the ONT, it does have a ground lug that can be connected to either panel ground or a metallic cold water pipe. It grounds the coax shield, nothing more. Sometimes coax is ground elsewhere through a splitter or a ground block, which sounds like the setup in your home. This type of ground is for safety, not surge protection.
If coax or other low voltage cables has long runs in the walls, they could couple with nearby strikes and cause induced currents that will force their way into equipment. Then the current finds it's way out through the weakest link, which could be any metallic path (HDMI...).
Again, unless you install a commercial grade panel surge protector, protectors on every metallic line that enters the building or has long in-wall runs, lightning rods with a proper ground field, and more; stuff like this will happen if a strike is close enough. But that's a rare occasion unless you live in an area with lots of storms.
For my money, a panel protector is a cost effective way to handle all but the most extreme events.