Surge protectors work even without a ground connection, only not as well. They'll still protect against line-neutral surges, just not against line-ground or ground-neutral surges, which unfortunately seem to be more common. A GFCI is a good idea in most cases, and you can buy plug-in versions for about $12:
An apartment with only 2-wire outlets is really old, probably pre-1970, and may have wire insulation that's in poor shape and is possibly a fire hazard if it isn't completely encased in metal conduit. OTOH it's possible the outlets are grounded to any metal boxes they're in, so take a wall outlet tester and plug it into a 2-prong adapter with the adapter's ground prong attached to the outlet's center screw. The tester can tell you if there's a ground connection, and so can many surge protectors equipped with a ground check LED. Some backup supplies will even beep if there's no ground connection.
Another test you always want to do with the wiring is plug in a Kill-A-Watt and run a hair dryer or 4-slice toaster at full blast. The Kill-A-Watt's voltage reading drops by more than a couple of volts means the wiring is in bad shape, most likely with some loose connections. At the house where I used to live, I found a couple of outlets that dropped to 90V when I ran a power saw.
Any chance of stirring up trouble by having the city building inspector or fire dept. visit the apartment complex?