This happened to someone I know while they were traveling. Their (http://) Wordpress site was taken over and filled with malware a few seconds later.

I'd be more concerned about advertising/marketing companies collecting data about unencrypted websites visited by users on their public Wi-Fi as opposed to rare malicious actors who are typically isolated to a single location.

I’d rather be tracked everyday than be pwned once. Nevertheless, what I posted is just an example against the “no rational threat vector” reply.