A surge protector works by transferring any surge to ground.
An effective surge protector works by connecting a surge current to earth ground. That is completely and electrically different from the human safety ground in a wall receptacle. Human safety ground means no electricity should be felt in any part.
Shocks would be due to a defective safety ground. That receptacle tester can only report some safety ground defects - cannot report something as good. Apparently a surge protector, that does not claim to protect from destructive surges (ie no earth ground), has also compromised a human safety ground.