If you're sure you don't trust any dodgy certificates, sure you aren't vulnerable to any kind of downgrade attacks, sure you don't use any less-than-good sites,

If you're sure you don't trust any dodgy certificates, sure you aren't vulnerable to any kind of downgrade attacks, sure you don't use any less-than-good sites, sure you're using DNS over https 100% of the time, sure you never use any unencrypted and/or unauthenticated protocols (like plain SMTP for instance), and sure you don't have any ports open then... yeah, I guess it's mitigated. My personal preference would be to just use a VPN when on any untrusted network. At least then you only have to worry about the security of one "site," more or less. And of course your own open ports.