I'm in the process of recommenging serious surge suppression with multiple layers for a client. They lost a major press due to a surge. They have a 1200, 2000, and another 2000A service and I will be adding a 3000A service.
Providing protection in layers is certainly the way to go.
The unit at the incoming service will protect them from external problems, but internal plant VFD's will generate their own spikes. That's where a second or third layer is needed. What one spends for prevention is nothing compared to the lost revenue from a prolonged shutdown!
Remember, there are surge suppressors of every flavor, price, and effectiveness. Do you homework looking at specs - in between the lines, too. Even the big names don't fully meet the standards. I have seen units several feet in dimensions not even coming close in effectiveness to a quality unit smaller than a breadbox. The devil's in the guts, or the lack thereof.
Installation is absolutely critical. The shorter the leads, the better! As for instrumentation, telephone, data, etc. you need protection at BOTH ends.
RG