At places where I did work anything private over even properly protected wifi was forbidden after several wifi vulns in 2018. So the only thing available on company's wifi was vpn gateway and page with manual how to set it up.

So, not trusting anything wireless is a thing for almost a decade.

For the public WiFi threat vector (e.g. a rogue WiFi AP running MITMproxy to sniff your traffic) you would be protected by vpn.

But the broader threat, e.g. older & unpatched devices with these flimsy CAs installed & not upgradable or revocable – tough cookies.