I think there's a significant difference between using an open (or even poorly secured, although I've never done that) hotspot in order to get onto the internet

I think there's a significant difference between using an open (or even poorly secured, although I've never done that) hotspot in order to get onto the internet, vs deliberately capturing personal data from that hotspot with the intention to analyze it and possibly use it to harm the subjects of that data.