You're on the right track. There are a couple contributions you've missed:
- The MOSFET itself has output capacitance.
Turn-off dV/dt and dI/dt are never truly unlimited, of course; and even if the switching node weren't loaded with capacitance, and the MOSFET driven with an ideal step gate voltage, no real transistor switches off instantaneously, limiting dI/dt there. (In practice, internal capacitances, drive resistance, and common-source inductance limit both rates.)
Especially with modern transistors, this capacitance may not be all that much, not significant enough to limit peak voltage within ratings -- so you have the right suspicion that more (external capacitance) might be necessary.
- The transformer has capacitance, too!
This is easy to see when considering its construction: made of a spool of wire, each turn of wire overlaps the last, and so on, thus there is some capacitance between turns -- nope, it doesn't matter that it's all "the same wire", rather it matters that different parts of that wire are doing different things -- adding a volt or few with every pass around, and so there's voltage between turns, an insulator of some thickness (wire enamel + potting), and some area (width from the wire diameter, more or less, times the length distributed along the winding).
More or less; the layering or sectioning of the winding varies with design, but suffice it to say, sooner or later, there's a heck of a lot of turns on there, so the capacitance really adds up.
Most of all, the secondary's distributed capacitance is effectively multiplied by the turns ratio squared, so that, as seen from the primary side, the capacitance is really high indeed. It's no accident that, back in the days of "points" ignition, a fairly generous capacitor ("condenser") was used to mitigate sparking -- 0.2µF or so, and this didn't reduce peak voltage enough to cause problems.
There is still a dominant inductance as seen at the MOSFET, because of leakage inductance: the primary and secondary are not perfectly coupled, but there is some distance between them, and in that gap, leakage flux flows. This manifests as a series inductor into an ideal transformer, so even if the secondary were a short circuit (as it might be in a given instant, due to its capacitance; or during conduction, due to the spark's low voltage drop), the MOSFET still sees some inductance at the primary side, and some voltage clamping is desirable.
In any case, the effect is to store or dissipate some energy due to the inductance seen by the MOSFET: whether flyback from a free-wheeling (no spark) transformer, or just the leakage inductance. We can store that inductive energy in a capacitance (which then rings down over time, dissipating energy in circuit losses, or returning some to the supply), or dissipate it in a clamp, like a TVS.
MOSFET Ratings
You are right to suspect protection is desirable.
Back in the day, MOSFETs were not especially high-density (i.e. large die area for given switching capacity, particularly in high voltage ratings), and one of the side-effects of that was, high power dissipation capacity (big die area, easy heatsinking!) and avalanche withstanding (big die = big heat capacity, even for short, high-current pulses). Consequently, repetitive avalanche ratings were widely available.
These types are still available in certain legacy product lines, IRFP460 for example. Despite them having nearly an order of magnitude poorer performance compared to modern parts, many remain too useful to die, whether for general-purpose use where performance doesn't matter, or in niches where the "poor" performance is a virtue, like this, robust switching, or for linear amplifier application, power supply limiting, etc.. Examples include IR's HEXFET family (IRF(P)xxx(x), IRFZxxN, etc.), and competitor's / 2nd-sources' equivalent "planar stripe" (and some "mesh") processes. Some have also parlayed their now-otherwise-obsolete lines into boutique "linear" families (Littelfuse (previously IXYS) Linear L2 for example) -- and priced accordingly. :)
But in contrast, most modern devices have a fraction of the die area, and due to differences in construction, and the general push for miniaturization, robustness has declined. In particular, repetitive avalanche ratings are almost extinct (at least, I can't recall having seen a new-design MOSFET with the rating -- which isn't to say they don't exist at all, just that I haven't noticed one that did, or haven't come across one that does). Peak avalanche current (beyond which, forward-bias of the parasitic BJT occurs, typically followed by rapid destruction) tends to be lower, and only single-pulse avalanche ratings are given. (The energy figures are still usually quite generous, for what they are.) But that's the thing, it's single ever: maybe it survives one shot, maybe two, maybe it survives a hundred, but almost certainly not a million.
So, suffice it to say, an external protective device is helpful. A TVS does not have the complex construction of a MOSFET, and handles avalanche essentially forever. We can also integrate them into the device, so that current is made to flow through the channel instead (which avoids the cumulative breakdown mechanism of avalanche).
Consider these ignition coil driver IGBTs for example: LGD8201ATI They use an IGBT structure to get better device density (in particular, lower voltage drop at fairly high currents, in a small package, with surprisingly little gate voltage too), and offer quite acceptable UIS (Unclamped Inductive Switching) avalanche ratings -- a few hundred mJ in a package that size, is quite good. These also have internal gate resistance so they don't switch very fast: maybe not the best idea if you want to generate high voltages quickly, but when an ignition coil takes some 10s of µs to spike up anyway, this is still fine, and you save a lot of potential EMI (electromagnetic interference) issues, where the transformer's step-up ratio would otherwise make the plug cables act as antennas.
We can also consider snubber circuits, like the basic RC dampener, or a nonlinear type like an RCD rate (dV/dt) snubber, or peak clamp snubber:
simulate this circuit – Schematic created using CircuitLab
With the RCD snubbers, R1-C1 don't really do anything, but you can see their effect when deleting the others.
Note that, if D1 isn't conducting, R2-C2 serves the same role, so you'd never use both in combination, but dimension the RCD rate snubber so that the RC value provides this value, as well as the D-C rate snubbing that is desired.
The dV/dt snubbing isn't very visible here; we need to zoom in to see it better:
The rising edge has been stretched out over a few hundred ns, instead of the ~instantaneous (at this simulation timestep) rise it would otherwise have.