Fortunately a solution exists: the clamping voltage is not so strict as you imagine.
Ideally, we would have clamping voltage precisely no more than the maximum rating of the device (for a USB transceiver, that might be -0.3V to VCC + 0.3V), for any input current.
Alas, that is infeasible: the only clamping devices that precise (i.e. within fractions of a volt) are shunt regulators, and those contain an internal control loop which means they cannot respond immediately, but must ramp up their response -- so as to avoid overshoot or oscillation, and so as to land precisely on the target voltage -- precisely, but eventually. (The response time might be some microseconds, say for a TL431 with current-boosting transistor.)
There are other reasons, too: to sink say the 10A pulse of an ESD strike, quite a large transistor would be needed. So not only would the clamp take some microseconds to respond, but it would load the signal with some nF of junction capacitance -- pretty much making a USB link impossible, certainly at high speed.
In contrast, devices with low enough capacitance to be suitable, fast enough response speed, and high enough voltage rating not to load normal signals, have peak clamping voltages of say 10-20V.
So we must fall back on a less clear-cut clamping strategy.
The next best approach is to (in part) utilize the device's own clamping diodes. Say it's rated for 2kV HBM. If the application requires 8/15kV (contact/air discharge), it must be attenuated by about 8x, while presenting the same source impedance as seen by the IO pin. Or if the impedance is lower, the attenuation must be proportionally higher.
This is an important insight, because when we clamp ESD with a diode, the diode's internal resistance determines the circuit impedance. It might be a few ohms -- which provides effective clamping of the ~10A peak pulse -- but the remaining 10-20V then has that as the source impedance. Which means, if we wire it directly to the IO pin, the "10V ESD" pulse, at 1.5Ω, looks an awful lot like 10kV at 1.5kΩ -- if the IO pin is capable of sinking the same amount of current that is.
In practice, the IO pin will have some internal resistance too, and likely more than the external TVS diode -- so the two protective devices act together as a current divider, with more likely going to the external diode, and so ESD rating is already improved. But we're still putting quite a bit of energy into the IO pin, and it would be nice to avoid that.
The simple solution is to add resistance between them.
simulate this circuit – Schematic created using CircuitLab
Since the source impedance is quite low (ohms if that?), not much resistance is needed; 10Ω is enough to make a significant difference, and the more the merrier -- limited by signal bandwidth, and current requirements (when the IO is outputting).
Now, this is a solution, but mind what it's doing: it's still relying on internal clamp diodes. If current flow through these should cause internal latchup (typically CMOS devices exhibit this behavior for more than 100 or 200 mA of injected current), you have to power cycle the unit to restore normal operation. Which is termed class C compliance (device malfunctions until user intervention i.e. turn it off and back on, but otherwise survives without permanent damage.)
If you require class A or B compliance (no effect on performance or functionality; adverse effect, but recovers automatically), then a lower level of current injection is required. Perhaps a second stage clamp can be employed (diode, resistor, diode, resistor, IO pin). If the device gives a maximum current injection spec while maintaining normal operation (e.g., many MCUs indicate 5 or 10mA is acceptable on general-purpose pins), increase the resistance to meet that rating.
These are very good reasons why high-speed communications cables, like USB, Firewire, HDMI, etc. use shielded connectors with small pins hidden inside a shroud -- it is very difficult to subject such pins to errant ESD strikes without hitting the shroud instead, greatly increasing reliability without having to add any ESD devices at all.
It's still possible to strike such pins, of course -- a highly determined fool might hold a wire in their hand while probing into the housing, thus exposing individual pins to hazardous discharge. But that's a pretty contrived situation. And the more contrived these situations get, the less likely they are to occur in normal use. So connector and cable design is a big part of these standards being as reliable as they are.
The other possible situation is static charge accumulating on a cable. This is also somewhat contrived, as cables don't normally accumulate charge between their conductors. (On the whole thing, if unplugged at both ends -- sure, that's easy; but between wires in the cable itself?) But there are circumstances that can lead to that, and so a charged-cable event may be a similar concern.
Charged-cable transients are more powerful than ESD -- the impedance is lower, the characteristic impedance of the cable (say 50 to 120Ω) rather than an ESD network (300Ω or more?). But the voltage may also not be much, either, and so the effect can be quite similar to ESD -- in any case, it's handled the same way, too.
Mind that this all assumes that voltages and currents are where they are assumed to be. Typically this will be the case with a ground-plane PCB design, with the USB (or etc.) shield/shell grounded solidly to the plane. (It doesn't have to be a galvanic connection, the AC grounding is what's important; but if you're allowing some DC isolation, several bypass capacitors in parallel must be used, spread evenly around the connector / ground pins.) It will not, in general, be the case for a loose layout, like free wires in space (prototyping board), or a naive point-to-point layout without ground pour/plane. ESD contains frequencies that "do not like to stay in wires", and ground planes and shields are required to direct it into the relevant structures.
