Things have improved lately, but it wasn’t that long ago that the Chase banking app on iOS did not check the certificate hostname at all, meaning that MITM for the TLS it used was trivial.

There are risks, and fortunately they are reducing.

A VPN is still a good idea.