I wonder how likely it is though? The consumer access points don't come without passwords by default. Where I am, having an open access point without identifying the users is illegal, so it's unlikely a regular person would do that, and if some cafe does - it'd just have a captive portal asking for a phone number. And even if the business owner doesn't want to bother with that identification - there would 100% be a password on such a hotspot.