The Coffee Shop itself? Low. Other people in the coffee shop? High

Airport itself? Low Other people in the airport? High

It's not necessarily the place itself, but anywhere there's open (or easy to get) WiFi, the chance of nefarious users increases dramatically.

> Other people in the coffee shop? High

Citation needed. I get that it's trivial to actually do, but do you have any studies that show that a lot/any WiFi is being sniffed and/or MiTM'd? The most I've seen is airports and so on tracking people via MAC addresses or the WiFi AP names they request.

It's not Bob I'm worried about, it's the NSA prompting Bob's ISP to watch for my MAC to connect to any of their customer's routers.

And you think the NSA is having a particular difficult time monitoring what routes through Google servers?

Okay, let me be more clear: I don't expect the NSA to care much about me. I'm a Canadian citizen. I would rather my phone automatically suggest to me a VPN that ends up piping all my data to a country that doesn't have specific reason to be interested in me, than that I route my data in-the-clear over networks that are operated by governments who do have reason to care about me (because I'm one of their citizens and their laws apply to me, and they might want to figure out if I'm breaking them, etc.)

Android phones are sold globally, remember. There are much worse places to "moor your ship", data-wise, than the US. If this VPN circumvents Chinese Internet censorship, for example, then it's a win by sheer numbers, whatever it does to US domestic citizens.

In by that you're thinking Google could legally ship that in China without China having backdoor access to it?

Hell of a lot more difficult time than they are having monitoring the coffee shop's servers