For other readers who may be too young to remember, improper privacy controls (unenforced HTTPS, poor encryption in the form of WEP, easy MitM attacks, etc) meant that public/untrusted WiFi was a legitimate security risk as things like passwords, bank details, etc were very easy to steal as they were sent unencrypted over the air. This is fortunately much less true these days with the advent of better protections across the entire stack (HTTPS everywhere, WPA*, etc) but unscrupulous VPN merchants still use this outdated argument to try to sell their products to less technically-savvy customers.

What these technologies (and VPNs) _do not_ prevent is the legitimate (and consensual) capture of user data by captive portal software (email, phone, etc), which is typically submitted by a user wishing to connect to a public network. This is what the parent comment is mentioning. Different risk profiles, obviously.