Everyone is surprised. Also, creatures have advantage on attacking them during this round.
However, a smart party will make a watch to avoid such threats. You decide the timing the ambush will take, and roll stealth against the Passive Perception of the character who is watching. If he notices something, he will awake the rest of the party.
Agreed. You're either keeping alert for dangers or you're doing something else that prevents you from doing so. Sleeping fits the bill here in my view.
What makes this a challenge and not a screw job, however, is the DM making an effort to adequately telegraph the threat of a nighttime ambush. If you telegraph said threat and the players still choose to sleep without a guard or the like, that's on them.
Agreed. "Bandits are known to rob people moving along this road, are you sure you want to sleep here without someone doing guard duty?"