Without an actual grounding conductor, the surge protector has no way to drain a surge to ground.

The ungrounded GFI receptacle can shut off the power on a ground fault, which would protect a person, but a surge protector on such a circuit would be useless.