Yet users will use whatever is available. E.g. people routinely send SMS with sensitive data, even though SMS is probably the least trustworthy channel.

They can only help that by securing the equipment and networks. Telling public "don't trust these because foreign hackers" is not going to do much.

If you pay for icloud, there’s a button in iOS that tunnels everything over a tor-wannabe vpn.

There’s no real reason to trust wifi access points at this point, or demand they be trustworthy.

iCloud tunnel is so slow it’s unusable. And ISP can turn it off at will without your knowledge.

What are you talking about? It’s not slow at all.

Correlating sizes of data sent/received and precision timestamps is already huge intelligence. And the more entry/exit points you can tap on -- the better it becomes.