I'm convinced it came through the CATV although I can't prove it. I just have to assume the charge was small enough to pass but large enough to take out the HDMI which does not take much.
So a current came in on a CATV wire, did damage and stopped? We learned in elementary school science that electricity, to exist, must have both an incoming and outgoing path. What was an outgoing path?
Incoming path is from a cloud. Outgoing path is to earth. What was a path from that cloud, through an HDMI port, and then out to earth ground? Long before seeking a solution, first an anomaly (threat) must be defined.
A 'whole house' protector, properly installed, means direct lightning strikes without damage to anything. Even a protector must not fail. But no protector does protection - not one. So, if AC electric (the most common incoming path for damaged HDMI ports)was the incoming path, then that 'whole house' protector did not make a low impedance (ie less than 10 foot) connection to earth. Earth ground (not the protector) does the protection.
Did their tech verify an earth ground that exceeds what code requires? Or did he just verify a ground was sufficient to protect human life? Did every incoming wire (CATV, telephone, invisible dog fence, underground automatic lawn sprinklers, power to a detached garage) also make that same earth ground connection?
No protector does protection. Not one. A lightning rod also does not protect a structure. It is also only as effective as its earth ground. How good was an earth ground for every wire inside every incoming cable? If any one wire does not make that low impedance (ie less than 10 foot) connection to the one and only earth ground, then all protection is compromised.
Unfortunately, most want a solution inside a box. But no protector does protection. A protector is only a connecting device to what does protection. Even that CATV wire has best protection when it has no protector. (CATV filter does no protection.) Best protection is a low impedance (ie has no sharp bends or splices) hardwire connection to the same single point earth ground.
A surge was apparently inside. And probably outgoing via an HDMI port. So why did you all but invite that surge inside? Only you are responsible for providing and maintaining that earth ground. Surge was inside because it was not given a low impedance (ie hardwire not inside metallic conduit)connection to earth. An investigation begins there.
Technician can only verify a protector did not fail catastrophically - a completely unacceptable failure. Technician cannot tell if the protector has failed in the acceptable manner - degradation. However, a properly sized 'whole house' protector must not degrade even after multiple direct lightning strikes. Such surges are rare - maybe one every seven years. So degradation probably did not exist.
What human mistake resulted in lightning hunting for earth ground destructively inside? If all incoming wires are properly earthed, then no surge would be inside. An investigation for the human mistake begins at single point earth ground.
Ignore the myths about an induced surge. That transient only exists when one is told to fear; never learned numbers. Such transients have such trivial energy as to be eliminated even by an NE-2 neon glow lamp (ie less than 1 milliamp). Your damage means some direct connection existed.
BTW, that is a 'secondary' protection layer. Did anyone also inspect your 'primary' protection layer? Each layer is only defined by an earth ground. Are a CATV company's and AC utility's earth ground intact? Did anyone do those necessary inspection?
Plenty to do.