The risk to individuals is vastly overblown, but if 82% of people connect to any free WiFi they find and 1‰ of those are passing credentials insecurely, an attacker needs to sample on average 1220 people. That's about a hit a day at a busy coffee shop.

So y'all and I don't see a risk, but a malicious actor sees a valid strategy.