True. But I'm able to send all traffic through an encrypted tunnel so that nobody listening locally can get their hands on it. And if I wanted to, I could then tunnel all traffic over some other service to anonymize it.
obviously people able to setup their own VPN arent the target. even when connecting on open wifi without vpn im pretty you would spot anything suspicious