A surge protector is electrical distribution equipment, so it is allowed to be installed inside a panel. Occasionally we see them sitting loose in the bottom of a panel or leaning against the inside of the box; but manufacturers design them for installation outside the box on the side (through a knockout) or front (through a twist-out).
The primary reason is that they have small status lights that indicate that they have not been damaged by an electrical surge—or simply stopped working—and are still functional. Any sense of security gained by having surge protection for the appliances and circuits in your home would be terribly wrong if the device was not working, and you didn’t know it, when the next surge hits.