Ok if you are running that close to the max input voltage then maybe a slight over voltage at the mains might damage things but I probably would expect it run a bit beyond absolute max before really dieing.

If you take something designed to protect something expecting 110-240VAC and use it at the 24VAC nominal output it won't do much/anything. Is that what you mean? Typically they will be quite primitive - often just a MOV and inductor.

You're best to have some "headroom" between normal output (38-39VDC) and maximum input (40VDC) and try to clamp the voltage there to have some margin. If you increase the max input to 60VDC though then you get that already but that won't do much for an impulse which can easily be multiple kV at the 110-240V side (but for a very short time)

It depends a bit on the actual failure mode. A surge or impulse is different to a few seconds of over voltage (typically called a swell) and they require different protection. If just a simple swell, then more margin will do it with the 60V input. Not sure how a lightning strike might cause a swell other than maybe causing breakers to open reducing the load and thus the voltage will rise a bit. Then the breakers automatically reclose and the load increases/voltage reduces.

If a surge or impulse due to say a lightning strike, these are much shorter events of the order of milli/microseconds. Then you need to start looking at transorbs/MOVs. An MOV is the cheap and simple protection method for most things. Look to clamp it well above the normal output though since the 24(28)VAC will vary as you've seen. The MOV should not be conducting in normal use ever or it will just die even quicker.

I'm a believer in protecting as early as possible e.g. at the 24VAC line where I'd look to put something like a 33V or 39V MOV. Not 100% on values available in that range but something like that.