Most surge protectors use MOVs as the surge protection device (SPD). Under normal conditions, the MOV looks like an open circuit and doesn't conduct any current. But when a surge occurs, the MOV conducts, diverting the surge current to ground (or the other side of the line, e.g. hot to neutral).
I like to think of the MOV as a rope that frays with each surge. At some point, when it has carried too much surge current, the rope breaks and the MOV is no longer capable of doing its job. Manufacturers usually rate MOVs as being capable of a certain number of surges of so many Amps, such as 10 surges of 1000 Amps. But if a single surge is greater than 1000 Amps, that uses up more of the MOV's capacity.
What is supposed to happen with an MOV is that it conducts until it can handle no more, and then it turns into an open circuit. A large surge often causes the MOV to explode. But this doesn't always happen, especially when the over voltage condition is small. Then, the MOV may just remain as a short circuit, heating up and smoldering.
To protect against that case, a thermal cut out (TCO) can be added by the manufacturer of the surge protector. There are also MOVs that have an internal TCO, and then it is called a TMOV. If the temperature rises too much, then the TCO blows and the short circuit condition is removed.
So the bottom line is that the MOV may show obvious signs of damage due to a surge, but not always. Some surge protection devices include "failure" LEDs, but depending on the design, these aren't always a reliable indicator either. That makes knowing whether the SPD is still working or not a very frustrating exercise.