They get installed inline with the main house circuit breaker panel. Expensive.
It all depends on what level of protection you're going for. Protecting against a direct strike on your house would be excessively expensive for most people, if at all feasible (lightning nerds feel free to explain the massive EM fields and their air-ground-wiring interactions etc).
When we renovated our place (including fresh wiring throughout) I opted for an "industrial strength" surge protector mounted on the DIN rail in the main switch board. Back when I was doing the calculations for it, it should allow for an air-to-ground strike as close as a block away, and an air-to-supply-line strike twice(?) as far away. A strike like that would blow/exhaust the SPD, but also absorb the spike enough that my UPS doesn't fry, and the UPS in turn smooth out the remaining parts of the spike.
Things not behind the UPS are largely left to fend for themselves, except a few things like the TV which is on a power-board with a built-in surge protector (heaven knows how much help that would be, I don't even know if the label can be trusted).
Anyway, as I was saying, depending on the desired level of protection, it doesn't have to cost an arm and a leg. I only spent ~$350 or so extra to have the SPD installed. The electrician thought I was mad for going to such length in a residential place though...