They are certainly not useless but they are not perfect.
Firstly, as you might expect, lightening induced voltage surges are highly variable depending on the intensity of the strike, how far the strike was from the line and how long the line was from the nearest point to the strike and your property. Similarly surge protection devices have a variety of specifications depending on how much you are prepared to pay. It is quite possible, therefore, to experience a surge that is bigger than the device can cope with.
Secondly most devices act as a crow-bar circuit, i.e they put a momentary short across the line, from line to earth or, more usually, both. This diverts the surge current away from the protected equipment and limits the surge voltage. Because they are passing very high currents they may fail, e.g. because of multiple small surges or one very large surge, but they are designed to fail open circuit. This means that once the protector has failed your equipment will continue to operate but is no longer protected and the next surge could damage it. Some have indicator lights but not all and who checks anyway when it is tucked away behind the PC. Telephone lines can be protected with gas discharge devices which are less likely to fail than the semiconductor devices used to protect power lines.
It is worth noting that the EMC standards for all computing equipment, which would include modems, require such equipment to be tested for surge protection as part of CE marking regulations. There is little point in buying a cheap surge protector that only protects up to a relatively low voltage and current if the equipment is already protected to that level as part of its design.