User tries to grant their soundsystem access to their google music. Gets cut off and asked to reconnect as they're walking out the door. Ends up granting the cafe's soundsystem access instead, and maybe that gets combined with another exploit to give someone else at the cafe access to their documents.
User is in the habit of using the same username/password everywhere, enters it into http://192.168.1.1 on some hostile network.
User knows to use a password manager, but password manager is happy to put their router password into some other router's login; attacker uses this to subvert their router
Thief replaces the home webcam with one that supplies a dummy image, takes their time to clear the place out.