I would call that a half-truth. When I was a kid (in the early 2000's) it was exceptionally easy to crack public wifi networks. A lot of that had to do with misconfiguration and every company scrambling to create public wifi APs. It makes sense that these memories and experiences live on and have become slogans of companies vying for privacy.
Once I figured out packet injection (before cellphones) I actually cracked some random company WEP in a parking lot when my friends and I got lost in order to look up directions.
Nowadays things are a lot less fun. :(
I remember buying a network adapter with packet injection capabilities SPECIFICALLY for this haha
Driver support for packet injection in Kali Linux is fantastic now, making it easy to spray de-auth packets with most hardware and capture your auth packets without having to wait.
I tested out Hashcat recently with my GTX 1060 (a modest card), and could burn through 170k WPA2 hashes a second. That's a long way from brute force, but doable for most wordlist attacks.
But you're not a kid anymore and nowadays it's way harder to crack public wifi networks.
Fearmongering by VPN vendors is very real.
I wouldn't have a problem browsing my home banking on a public wifi network. Everything is tls-encrypted, my browser can do dns-over-https, and anything important (including the login) requires me to enter an one-time code from my non-smart token.
And by the way, on a public wifi you might be pray of the occasional wifi attacker where as if you're using a vpn from a vpn vendor you're by definition giving all your traffic to a company whose main specialty is networking, usually under the vague promise not to log your traffic.
This may be because public wifi networks are public, which means they're open, which means there's no wifi password or encryption. Cracking a public wifi network takes all the effort of merely joining the wireless network with a mobile device.