It's not the design, it is the device. A transient pulse needs to be dissipated. To do that, the MOV becomes a short and then when the voltage decreases, it can become a high resistance path again. However, when the conduction time is beyond a certain amount of energy, heating occurs and the crystalline structure of the MOV can crack, melt, etc. and the device has protected it's last time.
I dug up an old circuit of a surge suppressor we fielded:
This has both three and two lead MOVs. It also has redundancy since there are slight variations in performance of MOVs. Also, all the combinations of transient possibilities are protected.
This one is designed to let the MOV shorting out cause the isolation relay to disengage.