Hot take: "public wifi is bad, you *will* get owned if you use it" is outdated advice, especially given that TLS is now considered mandatory, not just "standard"
The VPNs being sold with this outdated advice are statistically more likely to be a security threat than your coffeeshop's wifi
TLS is actually a standard but it's not everywhere yet.
An activist-run VPN is sometimes acceptable.
A Mastodon instance for info/cyber security-minded people.