Yeah that's a very interesting point. Man-in-the-Middle attacks are actually easier to do on a public hotspot / WIFI of course.
But I think that using a VPN or TOR should be enough to protect you from them, as your traffic should not be visible to the owner of the network in question. In theory, if your traffic is end-to-end encrypted, the attacker won't be able to see or modify your data.
I'm not saying it's ideal, I'm just saying that with a minimum of protection, it's theoretically feasible.
This is not my specialty, so if a specialist wants to correct me if I'm wrong, I'd be happy to learn more about it.