One way to look at it is: if a TVS does experience (and suppress) a large transient that causes it to fail open (and, thus, unable to protect against further transients), your equipment at least had one transient less than it would have without a TVS in place. And less is better (although none would be best).
For the interested, I found this discussion of TVS failure modes from the good folks at Vishay:
