Well ... various scenarios are possible: building to building, inside building. The distance also varies from lets say 30m to over 600m.
Protection is always about how current gets to earth. Anything that would stop that current only suffers even higher voltages. Surge is a current source. Voltage increases as necessary so that a current (typically 20, 000 amps) will still flow.
Devices mounted on towers to measure lightning currents use the single point connection technique. Every wire that enters the box first connects to the same point. Either directly via a wire. Or via a protector device. Most important - all wires make that short connection to the same point. Only then will current have no reason to be incoming and outgoing via that box.
Same solution applies to every building. Each wire inside every incoming cable first makes a low impedance (ie 'less than 3 meter') connection to single point earth ground. Only then will a destructive current need not enter the building. Protection again is never about a protector. That current connects low impedance (ie no sharp wire bends, no metallic conduit) to earth by a wire. Or makes the same low impedance connection via a protector. Protection means you provide the best (low impedance) connection to earth. And know why that current need not enter your building or box.
In all cases, no protector does protection. Protection is only provided by a ground point. For every building, that is single point earth ground. Protectors or hardwire connection do same. Make a low impedance (ie no splices) connection to earth. If any incoming wire doesn't, then all protection is compromised.
Protection is never about stopping or blocking a surge. Protection is always about giving that current (ie 20,000 amps) a low impedance connection to the single point ground. So that no current need pass through a box or be inside a building.