Is it normal for GFCI receptacles to explode and burn?
This happens all the time if an exterior GFCI is not weather-resistant. I've never had a weather resistant GFCI go up in smoke.

Yes, they can be in a metal box, but they still should be marked WR (weather resistant) - this means the electronics inside are coated to reduce the chances of moisture causing exactly what happened with your GFCI.

If it had shorted to the box, the metal screw would have arced and tripped the breaker. If it had shorted on the load side, it would have tripped the GFCI. But, in this case, enough moisture got in and the electronics shorted and let the magic smoke out.

Last item on the list is that it should have an in-use cover or an extra duty cover, that allows a cord to be plugged in with the cover protecting from rain.

In this case, replace your GFCI with a WR rated GFCI and add an in-use cover to greatly reduce the chance of this happening again. In some jurisdictions the local ordinances require the outlet itself to be GFCI so it can be reset (not running cords inside because of tripping the GFCI in wet grass with an electric mower is the "why" the inspector told me).