Protecting USB hub from ESD
There are two kinds of issues with ESD. One is irreparable loss of functionality, due to physical damage (or fatigue) caused by ESD events. In this case extra protection does help, provided that the extra components don't destroy USB signal integrity way beyond specifications.

The second kind is temporal functional disruption. There are several possibilities how an ESD event can disrupt the USB data flow. The most serious problem is when the cable shield on hub ports (in both directions) is not connected properly to signal ground plane, if it is simply tied together. In this case the ESD current spike goes along the shield and causes signal ground bounce, either within the hub itself, or within the USB host system. This creates signal collisions that are unexpected by USB protocol, so a hub will intentionally "garble" upstream signals (see Section 11.8.3, Collision), and the host port will be forced into disabled state. This is a mandatory feature of USB 2.0 hubs. Devices don't do this, that's why your FTDI device is less susceptible to ESD when plugged directly into root port. Since the problem is likely in improper shield connection inside your selected hub, no external extra protection will be able so help.

To fix your ESD sensitivity problem you will need to find a "better hub", or modify the current one by de-coupling the shield net from ground net.

AMPLIFICATION: Here is an idea how the shielding should be implemented in a SYSTEM:



There could be some weak coupling introduced between signal GND and SHIELD in host and hub, but all depends of geometry/conductivity of shielded components, and whether FCC EMI is of concern.